https://vanemmerik.ai/supply-chain/ Supply Chain Watch entries: AI models. en https://vanemmerik.ai/supply-chain/2026-10-25/#hf-datasets-pandas-pickle-rce vea-sc-2026-10-25-hf-datasets-pandas-pickle-rce Sun, 25 Oct 2026 16:05:00 +0000 CVE-2026-57845 (CVSS 8.8, published Oct 24 by VulnCheck) covers datasets.load_dataset("pandas", ...), which hands user-supplied files to pandas.read_pickle, so a crafted dataset file runs code with the loader's privileges. All versions through 5.1.0 are listed as affected, a fix is proposed in PR #8879 but not released, and the researcher has published a proof of concept. Exposure is limited to pipelines that load third-party datasets through the pandas builder, but that is a common pattern in ML training jobs. What to do: Do not load untrusted datasets with the pandas builder; prefer Parquet, CSV or JSON loaders and pin datasets until a fixed release ships. https://vanemmerik.ai/supply-chain/2026-10-23/#litellm-1-107-0-compromise vea-sc-2026-10-23-litellm-1-107-0-compromise Sat, 24 Oct 2026 02:45:00 +0000 On Oct 21 a release built from a lookalike repository pushed backdoored litellm 1.107.0 wheels to PyPI and matching images to GHCR and Docker Hub. The payload runs on every Python start via a .pth file, harvests cloud, CI, SSH and AI-tool credentials (and proxy provider keys when DATABASE_URL is set), and polls for remote code hourly. PyPI pulled the release in under two hours; the latest and main-stable Docker tags pointed at the bad image for roughly 2.5 hours. Researchers report the 1.106.x line as clean. What to do: Search lockfiles, image digests and mirrors for 1.107.0. If it ran anywhere with network access, rebuild that environment, pin litellm==1.106.2, block litellm.dev, and rotate every credential the host could reach.