CVE-2026-65010: HF Datasets symlink following

CISO Take

Hugging Face's `datasets` library follows filesystem symlinks during archive extraction, letting a local attacker who can pre-plant a symlink at a predictable cache path redirect the write to any file the extracting process can access. This matters most on shared or multi-tenant ML compute — training servers, notebook clusters, CI runners — where multiple users or jobs share a dataset cache directory and one low-privileged local account can tamper with another's extraction target. There's no EPSS score, no CISA KEV listing, and no public exploit or Nuclei template for this one, so it's not an internet-facing, mass-exploitable bug — the CVSS 6.6 and local/user-interaction-required vector reflect that. The concrete action is to update to the release containing fix commit ad2d853ae2ce41d8068c23b44c2e29004312ccee, and in the meantime avoid extracting datasets into shared, predictable cache paths on multi-tenant hosts or run extraction under an isolated, least-privilege account.

Sources: NVD GitHub Advisory CISA KEV ATLAS vulncheck.com

What is the risk?

Medium severity (CVSS 6.6, AV:L/AC:L/PR:L/UI:R). Exploitation requires local access plus a user action that triggers extraction, which limits the attack surface to shared or multi-tenant environments rather than remote/internet-facing systems. No EPSS data, no CISA KEV listing, and no known public exploit or scanner template exist, indicating this is not currently being mass-exploited. The realistic risk concentration is on shared ML training infrastructure, CI/CD pipelines, and notebook servers where a low-privileged local user can pre-plant symlinks and wait for another job to run dataset extraction.

How does the attack unfold?

Pre-position symlink

A local low-privileged attacker on a shared host creates a symlink at the predictable output path `datasets` will use during extraction, pointing it at a sensitive target file.

AML.T0010.001

Victim triggers extraction

A victim user or automated pipeline calls `load_dataset()`, causing `Extractor.extract()` to unpack a legitimate dataset archive into the shared cache path.

Symlink followed, file overwritten

The extractor follows the attacker's symlink instead of writing inside the intended cache directory, overwriting the sensitive target file with archive content (CWE-61).

Privilege escalation / code execution

If the overwritten file is later executed or loaded with elevated privileges (e.g., a shell profile, cron job, or config read by a privileged process), the attacker gains code execution or escalated privileges on the shared host.

Pre-position symlink

A local low-privileged attacker on a shared host creates a symlink at the predictable output path `datasets` will use during extraction, pointing it at a sensitive target file.

AML.T0010.001

Victim triggers extraction

A victim user or automated pipeline calls `load_dataset()`, causing `Extractor.extract()` to unpack a legitimate dataset archive into the shared cache path.

Symlink followed, file overwritten

The extractor follows the attacker's symlink instead of writing inside the intended cache directory, overwriting the sensitive target file with archive content (CWE-61).

Privilege escalation / code execution

If the overwritten file is later executed or loaded with elevated privileges (e.g., a shell profile, cron job, or config read by a privileged process), the attacker gains code execution or escalated privileges on the shared host.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
HF Datasets	pip	—	No patch
21.7K OpenSSF 6.1 2.8K dependents Pushed 7d ago 86% patched ~4d to patch Full package profile →

Do you use HF Datasets? You're affected.

How severe is it?

CVSS 3.1

6.6 / 10

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Local

AC Low

PR Low

UI Required

S Unchanged

C None

I High

A High

What should I do?

1 step

Patch: upgrade datasets to the release that includes fix commit ad2d853ae2ce41d8068c23b44c2e29004312ccee (huggingface/datasets, see PR #8303 / issue #8296). Workarounds if immediate patching isn't possible: avoid shared, predictable cache directories on multi-tenant hosts — set HF_DATASETS_CACHE / HF_HOME to a per-user or per-job directory with restrictive permissions (0700); run dataset extraction under a dedicated low-privilege service account rather than a shared one; disable symlink-following at the filesystem/mount level for shared cache volumes where feasible. Detection: audit shared dataset cache directories for unexpected symlinks pointing outside the cache root before and after extraction jobs, and monitor file-integrity on sensitive local paths (shell profiles, cron files, systemd units) on hosts that run automated datasets extraction.

How is it classified?

Code Execution Supply Chain Training Data Framework AML.T0010.001 - AI Software

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.7.4 - Data resources

NIST AI RMF

GOVERN 6.1 - Third-party risk management

OWASP LLM Top 10

LLM05 - Supply Chain Vulnerabilities

Frequently Asked Questions

What is CVE-2026-65010?

Hugging Face's `datasets` library follows filesystem symlinks during archive extraction, letting a local attacker who can pre-plant a symlink at a predictable cache path redirect the write to any file the extracting process can access. This matters most on shared or multi-tenant ML compute — training servers, notebook clusters, CI runners — where multiple users or jobs share a dataset cache directory and one low-privileged local account can tamper with another's extraction target. There's no EPSS score, no CISA KEV listing, and no public exploit or Nuclei template for this one, so it's not an internet-facing, mass-exploitable bug — the CVSS 6.6 and local/user-interaction-required vector reflect that. The concrete action is to update to the release containing fix commit ad2d853ae2ce41d8068c23b44c2e29004312ccee, and in the meantime avoid extracting datasets into shared, predictable cache paths on multi-tenant hosts or run extraction under an isolated, least-privilege account.

Is CVE-2026-65010 actively exploited?

No confirmed active exploitation of CVE-2026-65010 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-65010?

Patch: upgrade `datasets` to the release that includes fix commit ad2d853ae2ce41d8068c23b44c2e29004312ccee (huggingface/datasets, see PR #8303 / issue #8296). Workarounds if immediate patching isn't possible: avoid shared, predictable cache directories on multi-tenant hosts — set `HF_DATASETS_CACHE` / `HF_HOME` to a per-user or per-job directory with restrictive permissions (0700); run dataset extraction under a dedicated low-privilege service account rather than a shared one; disable symlink-following at the filesystem/mount level for shared cache volumes where feasible. Detection: audit shared dataset cache directories for unexpected symlinks pointing outside the cache root before and after extraction jobs, and monitor file-integrity on sensitive local paths (shell profiles, cron files, systemd units) on hosts that run automated `datasets` extraction.

What systems are affected by CVE-2026-65010?

This vulnerability affects the following AI/ML architecture patterns: training pipelines, shared/multi-tenant ML compute environments.

What is the CVSS score for CVE-2026-65010?

CVE-2026-65010 has a CVSS v3.1 base score of 6.6 (MEDIUM).

What is the AI security impact?

Affected AI Architectures

training pipelinesshared/multi-tenant ML compute environments

MITRE ATLAS Techniques

AML.T0010.001 AI Software

Compliance Controls Affected

ISO 42001: A.7.4

NIST AI RMF: GOVERN 6.1

OWASP LLM Top 10: LLM05

What are the technical details?

Original Advisory

Datasets through 5.00, fixed in commit ad2d853, contains a symlink-following vulnerability in Extractor.extract() that allows local attackers to write arbitrary files by pre-planting symlinks at predictable output paths. Attackers can redirect archive extraction to arbitrary filesystem locations in shared-cache environments, enabling overwrite of sensitive files and potential privilege escalation or code execution.

Exploitation Scenario

On a shared ML training cluster, several data scientists' jobs share a `datasets` cache directory at a predictable path (e.g., `~/.cache/huggingface/datasets/<dataset-name>/<hash>/`). A low-privileged local attacker with an account on the same host pre-creates a symlink at that predictable output path pointing to a sensitive target file — for example another user's `.bashrc`, an SSH `authorized_keys` file, or a config file loaded by a privileged automation job. When a victim (or a scheduled pipeline) subsequently runs `load_dataset()` to download and extract a legitimate dataset archive, `Extractor.extract()` follows the attacker's symlink instead of writing inside the intended cache location, overwriting the sensitive file with archive contents. If that overwritten file is later sourced, executed, or loaded with elevated privileges, the attacker achieves code execution or privilege escalation on the shared host.

Weaknesses (CWE)

CWE-61 UNIX Symbolic Link (Symlink) Following Primary

CWE-61 — UNIX Symbolic Link (Symlink) Following: The product, when opening a file or directory, does not sufficiently account for when the file is a symbolic link that resolves to a target outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files.

[Implementation] Symbolic link attacks often occur when a program creates a tmp directory that stores files/links. Access to the directory should be restricted to the program as to prevent attackers from manipulating the files.
[Architecture and Design] Follow the principle of least privilege when assigning access rights to entities in a software system. Denying access to a file can prevent an attacker from replacing that file with a link to a sensitive file. Ensure good compartmentalization in the system to provide protected areas that can be trusted.

Source: MITRE CWE corpus.