CVE-2026-66007: HF Datasets path traversal

CISO Take

A path traversal flaw in HuggingFace's `datasets` library lets a malicious dataset's file_name metadata field escape the expected directory and read arbitrary files from the machine that loads it, with the contents silently embedded into the dataset output. There's no CISA KEV listing, no EPSS score, no public exploit, and no scanner template for this one, and exploitation requires a victim to actively load and process a crafted dataset — so this isn't an internet-scan risk, it's a supply-chain trust risk for teams that pull datasets from HuggingFace Hub or other external sources. The real danger is downstream: if the resulting dataset is later pushed to the Hub or shared, any leaked local file (credentials, SSH keys, config) goes with it. Upgrade past the fix commit f989ef9 (post-5.0.0) immediately, and treat any dataset processed with an older `datasets` version and later published via `push_to_hub` as a potential leak to audit.

Sources: NVD GitHub Advisory ATLAS vulncheck.com

What is the risk?

Medium severity (CVSS 6.5, confidentiality-only impact) but the exploitation path is narrow: it requires user interaction (loading and processing an untrusted dataset with a folder-based builder), so this is not remotely exploitable without victim action. No evidence of active exploitation, no EPSS percentile, no public PoC, and not in CISA KEV — current real-world risk is low, but the impact ceiling (arbitrary local file read, potentially re-published via push_to_hub) is high enough to warrant prompt patching wherever untrusted or third-party datasets are ingested.

How does the attack unfold?

Poisoned dataset distribution

Attacker publishes or sends a dataset using a folder-based builder with a crafted file_name metadata value containing directory traversal sequences.

AML.T0019

Victim loads dataset

A data scientist or pipeline loads the malicious dataset with `load_dataset()`, requiring user interaction to trigger the flaw.

AML.T0011

Path traversal read

Unvalidated file_name is joined to the dataset directory, causing the library to read an arbitrary local file outside the intended path.

AML.T0037

Exfiltration via output

The leaked file content is embedded into the dataset and exposed when `save_to_disk()` or `push_to_hub()` is called, potentially exfiltrating it to a shared or public location.

AML.T0025

Poisoned dataset distribution

Attacker publishes or sends a dataset using a folder-based builder with a crafted file_name metadata value containing directory traversal sequences.

AML.T0019

Victim loads dataset

A data scientist or pipeline loads the malicious dataset with `load_dataset()`, requiring user interaction to trigger the flaw.

AML.T0011

Path traversal read

Unvalidated file_name is joined to the dataset directory, causing the library to read an arbitrary local file outside the intended path.

AML.T0037

Exfiltration via output

The leaked file content is embedded into the dataset and exposed when `save_to_disk()` or `push_to_hub()` is called, potentially exfiltrating it to a shared or public location.

AML.T0025

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
HF Datasets	pip	—	No patch
22.0K OpenSSF 6.4 2.9K dependents Pushed 4d ago 86% patched ~19d to patch Full package profile →

Do you use HF Datasets? You're affected.

How severe is it?

CVSS 3.1

6.5 / 10

EPSS

0.6%

chance of exploitation in 30 days

Higher than 45% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR None

UI Required

S Unchanged

C High

I None

A None

What should I do?

1 step

Upgrade datasets to the version containing fix commit f989ef9 (post-5.0.0) immediately. Until patched, avoid processing datasets from untrusted or unverified sources with folder-based builders, or do so only in sandboxed environments with no sensitive files (credentials, SSH keys, internal configs) reachable from the process's filesystem access. Audit any datasets previously processed with a vulnerable version and subsequently pushed to HuggingFace Hub or shared externally for embedded file content that shouldn't be there. Add dependency scanning to catch outdated datasets versions in CI/CD for ML pipelines.

What does CISA's SSVC say?

Decision Track*

Exploitation poc

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Data Leakage Supply Chain Training Data Framework AML.T0010.002 - Data AML.T0019 - Publish Poisoned Datasets AML.T0025 - Exfiltration via Cyber Means AML.T0037 - Data from Local System

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 10 - Data and data governance

ISO 42001

A.7.4 - Data provenance and quality

NIST AI RMF

MAP 2.3 - Third-party resources and data documentation

OWASP LLM Top 10

LLM05 - Supply Chain Vulnerabilities

Frequently Asked Questions

What is CVE-2026-66007?

A path traversal flaw in HuggingFace's `datasets` library lets a malicious dataset's file_name metadata field escape the expected directory and read arbitrary files from the machine that loads it, with the contents silently embedded into the dataset output. There's no CISA KEV listing, no EPSS score, no public exploit, and no scanner template for this one, and exploitation requires a victim to actively load and process a crafted dataset — so this isn't an internet-scan risk, it's a supply-chain trust risk for teams that pull datasets from HuggingFace Hub or other external sources. The real danger is downstream: if the resulting dataset is later pushed to the Hub or shared, any leaked local file (credentials, SSH keys, config) goes with it. Upgrade past the fix commit f989ef9 (post-5.0.0) immediately, and treat any dataset processed with an older `datasets` version and later published via `push_to_hub` as a potential leak to audit.

Is CVE-2026-66007 actively exploited?

No confirmed active exploitation of CVE-2026-66007 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-66007?

Upgrade `datasets` to the version containing fix commit f989ef9 (post-5.0.0) immediately. Until patched, avoid processing datasets from untrusted or unverified sources with folder-based builders, or do so only in sandboxed environments with no sensitive files (credentials, SSH keys, internal configs) reachable from the process's filesystem access. Audit any datasets previously processed with a vulnerable version and subsequently pushed to HuggingFace Hub or shared externally for embedded file content that shouldn't be there. Add dependency scanning to catch outdated `datasets` versions in CI/CD for ML pipelines.

What systems are affected by CVE-2026-66007?

This vulnerability affects the following AI/ML architecture patterns: training pipelines, RAG pipelines.

What is the CVSS score for CVE-2026-66007?

CVE-2026-66007 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 0.56%.

What is the AI security impact?

Affected AI Architectures

training pipelinesRAG pipelines

MITRE ATLAS Techniques

AML.T0010.002 Data

AML.T0019 Publish Poisoned Datasets

AML.T0025 Exfiltration via Cyber Means

AML.T0037 Data from Local System

Compliance Controls Affected

EU AI Act: Article 10

ISO 42001: A.7.4

NIST AI RMF: MAP 2.3

OWASP LLM Top 10: LLM05

What are the technical details?

Original Advisory

Datasets through 5.0.0, fixed in commit f989ef9, contains a path traversal vulnerability in folder-based dataset builders where the file_name metadata field is not properly validated before being joined to the dataset directory. Attackers can supply crafted file_name values with directory traversal sequences to read arbitrary local files, which are then embedded into output when save_to_disk or push_to_hub is called.

Exploitation Scenario

An attacker publishes a poisoned dataset to HuggingFace Hub (or sends one directly to a target) using a folder-based builder whose metadata file (e.g., a CSV/JSONL manifest) sets `file_name` to a traversal payload like `../../../../home/user/.ssh/id_rsa`. A data scientist loads the dataset locally via `load_dataset()` as part of a routine training-data prep step. When they call `save_to_disk()` to cache the processed dataset or `push_to_hub()` to publish it, the vulnerable path-joining logic resolves the traversal sequence, reads the targeted local file, and embeds its contents into the dataset output — which the victim may then unknowingly share publicly or with the attacker via the pushed dataset.

Weaknesses (CWE)

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Primary CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

[Implementation] Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylis
[Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.

Source: MITRE CWE corpus.