~ / search / GHSA-379c-qx7v-6h59

GHSA-379c-qx7v-6h59

Hugging Face Datasets folder-based builders allow path traversal through file_name metadata

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-66007

Packages

EcosystemPackageAffectedFixed in
PyPI datasets < 5.0.1 5.0.1

Details

As written in the advisory (Markdown source, shown as plain text).

Datasets through 5.0.0, fixed in f989ef9, contains a path traversal vulnerability in folder-based dataset builders where the file_name metadata field is not properly validated before being joined to the dataset directory. Attackers can supply crafted file_name values with directory traversal sequences to read arbitrary local files, which are then embedded into output when save_to_disk or push_to_hub is called.

References

External links from the advisory. They lead to third-party sites.