Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

PyPI package

datasets

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 6.9PyPIAmendedPublished

    Hugging Face Datasets folder-based builders allow path traversal through file_name metadata

    CVE-2026-66007 · GHSA-379c-qx7v-6h59

    Affected
    • PyPI datasets < 5.0.1
    Fixed in
    5.0.1· Vendor fix available
    Issue
    Datasets through 5.0.0, fixed in f989ef9, contains a path traversal vulnerability in folder-based dataset builders where the filename metadata field is not properly validated before being joined to the dataset directory. Attackers can supply crafted filename values with directory traversal sequences to read arbitrary local files, which are then embedded into output when savetodisk or pushtohub is called.

    Recommended action: Upgrade to 5.0.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →