Skip to content
fr Sign in
4.4 Medium

CVE-2026-65010 Datasets through 5.00, fixed in commit ad2d853, contains a symlink-following vulnerability in Extractor.extract() that…

Description

Datasets through 5.00, fixed in commit ad2d853, contains a symlink-following vulnerability in Extractor.extract() that allows local attackers to write arbitrary files by pre-planting symlinks at predictable output paths. Attackers can redirect archive extraction to arbitrary filesystem locations in shared-cache environments, enabling overwrite of sensitive files and potential privilege escalation or code execution.

Affected products and versions

Product Affected versions Fixed in
datasets 5.00 earliest → 5.00 No fix stated

References

Timeline

  1. Published
  2. Last modified

Other CVEs of datasets

The 3 CVEs of datasets →
CVE-2026-57845 Hugging Face Datasets through 5.1.0 contains an insecure deserialization vulnerability that allows attackers to… 8.7 High CVE-2026-66007 Datasets through 5.0.0, fixed in commit f989ef9, contains a path traversal vulnerability in folder-based dataset… 6.9 Medium
Track this CVE