Aller au contenu
en Se connecter
6.9 Moyenne

CVE-2026-66007 Datasets through 5.0.0, fixed in commit f989ef9, contains a path traversal vulnerability in folder-based dataset…

Description

Datasets through 5.0.0, fixed in commit f989ef9, contains a path traversal vulnerability in folder-based dataset builders where the file_name metadata field is not properly validated before being joined to the dataset directory. Attackers can supply crafted file_name values with directory traversal sequences to read arbitrary local files, which are then embedded into output when save_to_disk or push_to_hub is called.

Produits et versions touchés

Produit Versions touchées Corrigé en
datasets 5.0 premières → 5.0.0 Pas de correctif indiqué

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de datasets

Les 3 CVE de datasets →
CVE-2026-57845 Hugging Face Datasets through 5.1.0 contains an insecure deserialization vulnerability that allows attackers to… 8.7 Élevée CVE-2026-65010 Datasets through 5.00, fixed in commit ad2d853, contains a symlink-following vulnerability in Extractor.extract() that… 4.4 Moyenne
Suivre cette CVE