CVE-2026-66007

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-66007
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-66007.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-66007
Published
2026-07-24T14:58:10.035Z
Modified
2026-07-27T04:03:23.445669508Z
Severity
  • 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Datasets Path Traversal via Unsanitized file_name Metadata
Details

Datasets through 5.0.0, fixed in commit f989ef9, contains a path traversal vulnerability in folder-based dataset builders where the filename metadata field is not properly validated before being joined to the dataset directory. Attackers can supply crafted filename values with directory traversal sequences to read arbitrary local files, which are then embedded into output when savetodisk or pushtohub is called.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/66xxx/CVE-2026-66007.json",
    "cwe_ids": [
        "CWE-22"
    ]
}
References

Affected packages

Git / github.com/huggingface/datasets

Affected ranges

Type
GIT
Repo
https://github.com/huggingface/datasets
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
68ac1a9b35869aadb7ae29857be46f6489d6150d
Fixed
f989ef9b4cc6c0039a7a82458eebca49e2b58b4b
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "5.0.0"
        }
    ],
    "source": [
        "DESCRIPTION",
        "REFERENCES"
    ]
}

Affected versions

0.*
0.0.2
0.0.3
0.1.0
0.2.0
0.2.1
0.3.0
0.4.0
1.*
1.0.0
1.0.1
1.0.2
1.1.0
1.1.1
1.1.2
1.1.3
1.10.0
1.10.1
1.10.2
1.11.0
1.12.0
1.12.1
1.13.0
1.13.1
1.13.2
1.13.3
1.14.0
1.15.0
1.15.1
1.16.0
1.16.1
1.17.0
1.18.0
1.18.1
1.18.2
1.18.3
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.6.0
1.6.1
1.6.2
1.7.0
1.8.0
1.9.0
2.*
2.0.0
2.1.0
2.10.0
2.11.0
2.12.0
2.13.0
2.13.1
2.14.0
2.14.1
2.15.0
2.16.0
2.16.1
2.17.0
2.17.1
2.18.0
2.19.0
2.2.0
2.2.1
2.2.2
2.20.0
2.3.0
2.3.1
2.3.2
2.4.0
2.5.0
2.5.1
2.6.0
2.6.1
2.7.0
2.8.0
2.9.0
3.*
3.0.0
3.0.1
3.0.2
3.1.0
3.2.0
3.3.0
3.3.1
3.3.2
3.4.0
3.4.1
3.5.0
3.5.1
3.6.0
4.*
4.0.0
4.1.0
4.1.1
4.2.0
4.3.0
4.4.0
4.4.1
4.4.2
4.5.0
4.6.0
4.6.1
4.7.0
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
5.*
5.0.0
Other
alpha

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-66007.json"