PT-2026-64320 · Hugging Face · Datasets

George Chen · CVE-2026-66007 · Publicado 2026-07-24 · Atualizado 2026-07-24

NVD

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Datasets through 5.0.0, fixed in commit f989ef9, contains a path traversal vulnerability in folder-based dataset builders where the file name metadata field is not properly validated before being joined to the dataset directory. Attackers can supply crafted file name values with directory traversal sequences to read arbitrary local files, which are then embedded into output when save to disk or push to hub is called.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2026-66007

Produtos afetados

Datasets

Referências · 5

• 🔥 https://github.com/huggingface/datasets/issues/8324 · Exploit
• https://github.com/huggingface/datasets/pull/8325 · Nota
• https://github.com/huggingface/datasets/commit/f989ef9b4cc6c0039a7a82458eebca49e2b58b4b · Correção
• https://vulncheck.com/advisories/datasets-path-traversal-via-unsanitized-file-name-metadata · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-66007 · Nota de Segurança