{"id":"CVE-2026-66007","title":"datasets: Datasets: Information disclosure via path traversal vulnerability (CVE-2026-66007)","summary":"A flaw was found in datasets. This path traversal vulnerability allows a remote attacker to read arbitrary local files. By providing specially crafted file names in the metadata, an attacker can trick the system into including sensitive lo…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","cvssSource":"vendor","cwe":"CWE-22","vendor":"Red Hat","product":"Red Hat OpenShift AI (RHOAI)","affected":["exploit_intelligence","lightspeed_core","enterprise_linux_ai_rhel_ai 3","openshift_ai_rhoai"],"patched":["datasets 5.0.1"],"published":"2026-07-24","updated":"2026-09-15","sourceUpdated":"2026-09-15T15:39:49+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-66007.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-66007.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-66007"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2506794"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-66007"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-66007"},{"url":"https://github.com/huggingface/datasets/commit/f989ef9b4cc6c0039a7a82458eebca49e2b58b4b"},{"url":"https://github.com/huggingface/datasets/issues/8324"},{"url":"https://github.com/huggingface/datasets/pull/8325"},{"url":"https://www.vulncheck.com/advisories/datasets-path-traversal-via-unsanitized-file-name-metadata"}],"tags":["csaf","vex","red-hat","osv","pip"],"epss":0.00557,"epssPercentile":0.45292,"aliases":["PYSEC-2026-3716"],"ecosystem":"pip","ingestedAt":"2026-08-19T19:22:21.705Z","slug":"CVE-2026-66007","body":"## Overview\n\nA flaw was found in datasets. This path traversal vulnerability allows a remote attacker to read arbitrary local files. By providing specially crafted file names in the metadata, an attacker can trick the system into including sensitive local files when datasets are saved or published, leading to information disclosure.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Exploit Intelligence, Lightspeed Core, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI) · no fix planned: Exploit Intelligence, Lightspeed Core, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI) · updated 2026-09-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-66007.json)\n\n**datasets: Datasets: Information disclosure via path traversal vulnerability** — rated Moderate by Red Hat. Released 2026-07-24, updated 2026-09-15.\n\nAffected:\n\n- Exploit Intelligence\n- Lightspeed Core\n- Red Hat Enterprise Linux AI (RHEL AI) 3\n- Red Hat OpenShift AI (RHOAI)\n\nNo fix planned:\n\n- Exploit Intelligence\n- Lightspeed Core\n- Red Hat Enterprise Linux AI (RHEL AI) 3\n- Red Hat OpenShift AI (RHOAI)\n\nNot affected:\n\n- Exploit Intelligence\n- Red Hat AI Inference Server\n- Red Hat Enterprise Linux AI (RHEL AI) 3\n- Red Hat OpenShift AI (RHOAI)\n\n## Remediation\n\nWill not fix\n\nWorkarounds / mitigations:\n\n- To mitigate this issue, ensure that all `file_name` metadata processed by the `datasets` library, especially within folder-based dataset builders, is thoroughly validated and sanitized. Avoid processing `file_name` values from untrusted sources without strict input validation to prevent directory traversal sequences. This will prevent the embedding of arbitrary local files during `save_to_disk` or `push_to_hub` operations.\n\n## Package advisory (CVE-2026-66007)\n\nAffected packages:\n\n- `datasets < 5.0.1`\n\nPatched in:\n\n- `datasets 5.0.1`\n\nSource: https://osv.dev/vulnerability/PYSEC-2026-3716","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":203849,"id":"CVE-2026-66007","ts":1789490209840,"field":"cvss","old":null,"new":"6.5"},{"seq":203848,"id":"CVE-2026-66007","ts":1789490209840,"field":"severity","old":"none","new":"medium"}]}