datasets: Datasets: Information disclosure via path traversal vulnerability (CVE-2026-66007)

Overview

A flaw was found in datasets. This path traversal vulnerability allows a remote attacker to read arbitrary local files. By providing specially crafted file names in the metadata, an attacker can trick the system into including sensitive local files when datasets are saved or published, leading to information disclosure.

Vendor advisories

• Red Hat VEX · Moderate · affected: Exploit Intelligence, Lightspeed Core, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI) · no fix planned: Exploit Intelligence, Lightspeed Core, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI) · updated 2026-09-15 · vex

datasets: Datasets: Information disclosure via path traversal vulnerability — rated Moderate by Red Hat. Released 2026-07-24, updated 2026-09-15.

Affected:

• Exploit Intelligence
• Lightspeed Core
• Red Hat Enterprise Linux AI (RHEL AI) 3
• Red Hat OpenShift AI (RHOAI)

No fix planned:

• Exploit Intelligence
• Lightspeed Core
• Red Hat Enterprise Linux AI (RHEL AI) 3
• Red Hat OpenShift AI (RHOAI)

Not affected:

• Exploit Intelligence
• Red Hat AI Inference Server
• Red Hat Enterprise Linux AI (RHEL AI) 3
• Red Hat OpenShift AI (RHOAI)

Remediation

Will not fix

Workarounds / mitigations:

• To mitigate this issue, ensure that all file_name metadata processed by the datasets library, especially within folder-based dataset builders, is thoroughly validated and sanitized. Avoid processing file_name values from untrusted sources without strict input validation to prevent directory traversal sequences. This will prevent the embedding of arbitrary local files during save_to_disk or push_to_hub operations.

Package advisory (CVE-2026-66007)

Affected packages:

• datasets < 5.0.1

Patched in:

• datasets 5.0.1

Source: https://osv.dev/vulnerability/PYSEC-2026-3716