Skip to content
OpenAdvisories

Product · huggingface

datasets

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 6.5
    CVE-2026-66007

    Datasets Path Traversal via Unsanitized file_name Metadata

    Datasets through 5.0.0, fixed in commit f989ef9, contains a path traversal vulnerability in folder-based dataset builders where the file_name metadata field is not properly validated before being joined to the dataset directory. Attackers can supply crafted f…

    huggingface datasets datasets PyPI
  • Medium 6.6
    CVE-2026-65010

    Datasets Symlink-following Arbitrary File Write via Extractor.extract()

    Datasets through 5.00, fixed in commit ad2d853, contains a symlink-following vulnerability in Extractor.extract() that allows local attackers to write arbitrary files by pre-planting symlinks at predictable output paths. Attackers can redirect archive extract…

    huggingface datasets