datasets vulnerabilities
CVEs whose affected-version data names the datasets package (pip). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-66007Medium· 6.5PoCDatasets Path Traversal via Unsanitized file_name Metadata
Datasets through 5.0.0, fixed in commit f989ef9, contains a path traversal vulnerability in folder-based dataset builders where the file_name metadata field is not properly validated before being joined to the dataset directory. Attacker…
▾ Twilighthuggingface · datasetsEPSS 0.79%via CVEORG
CVE-2026-65010Medium· 6.6PoCDatasets Symlink-following Arbitrary File Write via Extractor.extract()
Datasets through 5.00, fixed in commit ad2d853, contains a symlink-following vulnerability in Extractor.extract() that allows local attackers to write arbitrary files by pre-planting symlinks at predictable output paths. Attackers can re…
▾ Twilighthuggingface · datasetsEPSS 0.17%via CVEORG