EUVD-2026-48361
GHSA-5cm7-hhj8-4m75
Severity by source
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local access and pre-planted symlink setup require AC:H; low-privilege local account needed (PR:L); victim must trigger extraction (UI:R); no confidentiality impact; scope unchanged per CVSS 4.0 SC/SI/SA:N signals.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
Datasets through 5.00, fixed in commit ad2d853, contains a symlink-following vulnerability in Extractor.extract() that allows local attackers to write arbitrary files by pre-planting symlinks at predictable output paths. Attackers can redirect archive extraction to arbitrary filesystem locations in shared-cache environments, enabling overwrite of sensitive files and potential privilege escalation or code execution.
AnalysisAI
Symlink following in HuggingFace Datasets through version 5.00 allows local low-privileged attackers to redirect archive extraction to arbitrary filesystem locations by pre-planting symlinks at predictable output paths in the shared cache directory. When a higher-privileged user or automated service subsequently triggers Extractor.extract(), the library writes archive contents through the attacker-controlled symlink, enabling overwrite of sensitive system files and potential privilege escalation or code execution. A publicly available exploit exists and an upstream fix is available via commit ad2d853, though no confirmed tagged release version has been independently verified.
Technical ContextAI
The vulnerability resides in the Extractor.extract() method within src/datasets/utils/extract.py of the HuggingFace Datasets Python library (CPE: cpe:2.3:a:huggingface:datasets:*:*:*:*:*:*:*:*), affecting all releases through 5.00. CWE-61 (UNIX Symbolic Link Following) describes the root cause: the extractor writes decompressed archive contents to output paths without first verifying whether those paths resolve through attacker-controlled symlinks. The shared HuggingFace cache directory (~/.cache/huggingface/datasets) is frequently mounted on shared filesystems in HPC clusters, multi-user ML training environments, and CI/CD pipelines, giving co-resident unprivileged users write access to cache paths that privileged processes also consume. The fix in commit ad2d853 adds two lines to the extraction logic: if the output path is a symlink (os.path.islink(output_path)), it is unlinked before writing proceeds, neutralizing the redirection.
RemediationAI
The upstream fix is available via commit ad2d853ae2ce41d8068c23b44c2e29004312ccee (https://github.com/huggingface/datasets/commit/ad2d853ae2ce41d8068c23b44c2e29004312ccee), merged through pull request #8303 (https://github.com/huggingface/datasets/pull/8303). Upgrade to a release of the datasets package that includes this commit; verify by checking that the installed version's extract.py contains the os.path.islink() guard before writing output paths. No specific tagged release version has been independently confirmed, so review the package changelog or pin to a commit at or after ad2d853. As a compensating control pending upgrade, restrict write permissions on the HuggingFace cache directory so only the owning user can write (chmod 700 ~/.cache/huggingface/datasets) - this prevents co-resident attackers from pre-planting symlinks, but breaks collaborative cache sharing in multi-user setups. In containerized environments, avoid mounting shared writable volumes to cache directories accessible by processes running at different privilege levels; use per-user or per-job ephemeral cache paths instead.
More in Hugging Face
View allThe huggingface/transformers library is vulnerable to arbitrary code execution through deserialization of untrusted data
Deserialization of Untrusted Data in GitHub repository huggingface/transformers prior to 4.36. Rated high severity (CVSS
Deserialization of Untrusted Data in GitHub repository huggingface/transformers prior to 4.36. Rated high severity (CVSS
A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the huggingface/transformers repository,
Path traversal in Hugging Face Datasets up to 5.0.0 allows attackers to read arbitrary local files when a victim process
Path traversal in Hugging Face Accelerate through 1.14.0 exposes two distinct attack outcomes when a user loads a crafte
Server-side request forgery in HuggingFace text-generation-inference through version 3.3.7 enables unauthenticated remot
A Regular Expression Denial of Service (ReDoS) vulnerability was identified in the huggingface/transformers library, spe
Remote code execution in Hugging Face Transformers 5.2.0 allows a malicious model repository to bypass the user's explic
Unauthenticated remote code execution in HuggingFace LeRobot (versions 0 through 0.5.1) stems from pickle.loads() being
A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, sp
A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, sp
Same weakness CWE-61 – UNIX Symbolic Link (Symlink) Following
View allSame technique Privilege Escalation
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today