CVE-2026-66007: Datasets Path Traversal Vulnerability

CVE-2026-66007 Overview

CVE-2026-66007 is a path traversal vulnerability [CWE-22] in the Hugging Face datasets library through version 5.0.0. The flaw resides in folder-based dataset builders, where the file_name metadata field is joined to the dataset directory without validation. An attacker who supplies a crafted metadata file can use directory traversal sequences or fsspec URL schemes to reference arbitrary local files. Those files are then read and embedded into the dataset output when save_to_disk or push_to_hub is invoked. The issue is fixed in commit f989ef9.

Critical Impact
A crafted file_name value such as ../../etc/passwd or file:// URL causes arbitrary local file contents to be embedded into dataset artifacts published by the victim.

Affected Products

Hugging Face datasets versions through 5.0.0
Folder-based dataset builders (folder_based_builder.py)
Workflows invoking save_to_disk or push_to_hub on attacker-supplied metadata

Discovery Timeline

2026-07-24 - CVE-2026-66007 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-66007

Vulnerability Analysis

The datasets library allows users to build datasets from folders containing a metadata file that references data files by relative name. The folder-based builder trusted the file_name value from metadata and joined it directly to the dataset directory. That trust boundary is violated whenever the metadata file itself is attacker-controlled, which is common for datasets shared on the Hugging Face Hub. An attacker can point file_name at ../../etc/passwd, an absolute path, or an fsspec URL such as file:// or local://. When the victim loads and re-publishes the dataset with push_to_hub or persists it with save_to_disk, the referenced host files are read and written into the output artifacts.

Root Cause

The builder normalized file_name but did not verify that the resulting path remained inside the metadata file's directory. It also did not reject fsspec URL schemes. Absolute paths, .. traversal sequences, and file:// or local:// URIs all resolved to arbitrary local files during the read step.

Attack Vector

Exploitation requires a victim to load an attacker-supplied dataset and then export it. User interaction is required, but no authentication or privileges are needed to publish a malicious dataset. Successful exploitation discloses local file contents from the machine performing the export — commonly a data scientist workstation or a CI runner with access to credentials, SSH keys, or model artifacts.

python

                         )
                     elif len(feature_path) == 0:
                         if item is not None:
+                            # Guard against path traversal (CWE-22): a crafted `file_name` such as
+                            # "../../etc/passwd" or an absolute path must not be able to escape the
+                            # metadata file's directory and read arbitrary files on the host.
+                            #
+                            # The attacker-controlled `file_name` must be a plain relative path. In
+                            # particular it must not introduce an fsspec URL scheme: `file://` and
+                            # `local://` resolve to arbitrary *local* files, and any other scheme
+                            # would sidestep the containment check below. Legitimate reads from a
+                            # downloaded archive use a `zip://<file_name>::<container>` URL where the
+                            # scheme lives on `downloaded_metadata_dir` (the container), never on the
+                            # `file_name` value itself, so forbidding "://" here does not break them.
+                            if "://" in item:
+                                raise ValueError(
+                                    f"Invalid metadata file_name '{item}': `file_name` must be a relative path "
+                                    f"pointing inside the directory containing the metadata file. URL schemes "
+                                    f"(e.g. 'file://', 'local://') are not allowed."
+                                )
                             file_relpath = os.path.normpath(item).replace("\\", "/")
+                            if (
+                                os.path.isabs(item)
+                                or os.path.isabs(file_relpath)
+                                or file_relpath == ".."
+                                or file_relpath.startswith("../")
+                            ):
+                                raise ValueError(
+                                    f"Invalid metadata file_name '{item}': `file_name` must be a relative path "
+                                    f"pointing inside the directory containing the metadata file. Absolute paths "

Source: GitHub commit f989ef9 — the patch rejects :// schemes, absolute paths, and .. traversal in the file_name metadata field.

Detection Methods for CVE-2026-66007

Indicators of Compromise

Metadata files (metadata.csv, metadata.jsonl) containing file_name values with .., leading /, or :// sequences
Dataset artifacts produced by save_to_disk or push_to_hub containing contents of system files such as /etc/passwd, .ssh/id_rsa, or .aws/credentials
Unexpected reads of sensitive files by Python processes hosting datasets versions ≤ 5.0.0

Detection Strategies

Scan cached and locally stored dataset metadata for file_name fields containing ../, absolute paths, or file:// / local:// URIs
Inventory Python environments and CI images for datasets package versions at or below 5.0.0
Audit recently published Hub repositories for embedded content that resembles host configuration or credential files

Monitoring Recommendations

Log filesystem reads issued by dataset builder processes and alert on access outside the dataset directory
Monitor CI/CD pipelines for calls to push_to_hub and correlate with unexpected file-read syscalls
Track outbound uploads of dataset archives that exceed expected size baselines

How to Mitigate CVE-2026-66007

Immediate Actions Required

Upgrade datasets to a version containing commit f989ef9 or later
Review any dataset built from third-party metadata before running push_to_hub or save_to_disk
Rotate credentials that were reachable from workstations or runners that processed untrusted datasets

Patch Information

The fix is committed as f989ef9 and tracked in pull request #8325. Additional context is available in issue #8324 and the VulnCheck Advisory. The patch rejects file_name values containing ://, absolute paths, or leading .. traversal.

Workarounds

Validate file_name fields in metadata before invoking folder-based builders and reject any value containing .., an absolute path, or a URL scheme
Run dataset builds inside a sandbox or container with no access to host secrets or credentials
Restrict loading of folder-based datasets to trusted sources until the library is updated

bash

# Upgrade datasets to a patched revision
pip install --upgrade "git+https://github.com/huggingface/datasets@f989ef9b4cc6c0039a7a82458eebca49e2b58b4b"

# Quick pre-flight check for suspicious file_name entries in local metadata
grep -RInE 'file_name\s*[:=].*(\.\./|^/|://)' ./datasets_cache || echo "No traversal patterns found"