Datasets Path Traversal via Unsanitized file_name Metadata

[nixpkgs-security-tracker]

Nixpkgs security tracker issue

CVE-2026-66007

6.9 MEDIUM | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): Active (A)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Active (A)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

Datasets Path Traversal via Unsanitized file_name Metadata

Datasets through 5.0.0, fixed in commit f989ef9, contains a path traversal vulnerability in folder-based dataset builders where the file_name metadata field is not properly validated before being joined to the dataset directory. Attackers can supply crafted file_name values with directory traversal sequences to read arbitrary local files, which are then embedded into output when save_to_disk or push_to_hub is called.

References

• Researcher Disclosure (technical-description, exploit)
• Pull Request (issue-tracking)
• Patch Commit (patch)
• https://www.vulncheck.com/advisories/datasets-path-traversal-via-unsanitized-file-name-metadata (third-party-advisory)

Affected packages

• python313Packages.datasets (pull requests)
  • 4.5.0@nixos-26.05
  • 4.5.0@nixos-unstable
• python314Packages.datasets (pull requests)
  • 4.5.0@nixos-26.05
  • 4.5.0@nixos-unstable
    Affected package maintainers: cc @osbm

Next steps

• Start here if this is your first security issue: Triaging and fixing security issues
• Backports are usually needed: Backporting security fixes

[binyaaminofficial]

This issue addresses a path traversal security vulnerability (CVE-2026-66007) in the Hugging Face datasets Python package (up to version 5.0.0).
How to Fix
Update the Package:
In Nix: Update your Nix flakes/channels once the patched package is merged, or override python3Packages.datasets in your Nix configuration to include patch commit f989ef9.
In Python / Pip: Upgrade datasets to the latest release containing commit f989ef9 (or version > 5.0.0).
Temporary Mitigation / Workaround:
If you cannot update immediately, avoid running save_to_disk or push_to_hub on untrusted folder-based datasets where the file_name metadata field contains unverified directory paths.