#HuggingFace

securityonline.info

PoC Published for Hugging Face Datasets RCE CVE-2026-57845 (CVSS 8.8) in Library With 38 Million Monthly Downloads

TL;DR Researcher Sai Teja Erukude has published full details and a working proof-of-concept for CVE-2026-57845. This Hugging Face datasets RCE flaw carries a CVSS score of 8.8. The bug affects every datasets release up to and including 5.1.0, the latest version on PyPI. PyPI Stats counts about 38.4 million downloads of the library in the past 30 days. The deprecated but still registered pandas builder passes user-supplied files straight to pickle deserialization.

dailyinference.news

Fast Chips, Full Notebooks: Why AI Stalls on Memory, Not Math

A chatbot keeps numerical notes on everything said so far, so it never has to start over. Those notes, called the KV cache, take up scarce chip memory, and researchers have found several ways to shrink them.

nousresearch.com

Introducing Arete-27B: Qwen3.8-27B Post-Trained To Reinforce Western Values

We post-trained Alibaba's Qwen3.8-27B to reinforce Western values on a Chinese-trained model, and measured what changed with an 803-prompt eval across seven value categories.