HuggingFace Datasets EUVD-2026-48361

Exploitation requires the attacker to hold a local system account with write access to the HuggingFace Datasets cache directory used by the target process - not merely read access. The critical enabling condition is a shared-cache topology: the same cache directory must be writable by the attacker and subsequently read/written by a higher-privileged user or automated service that triggers Extractor.extract(). This is common in HPC clusters, shared ML platforms, and CI/CD runners with shared NFS or volume mounts, but not present in single-user workstations or containers with per-user ephemeral cache paths. The attacker must also be able to predict the extraction output path before the extraction runs to successfully pre-plant the symlink; predictable or enumerable path naming (dataset name plus version hash) satisfies this. Passive user interaction (CVSS 4.0 UI:P) is required - a legitimate extraction job must be triggered by the victim process. Exploitation is blocked by per-user cache directory permissions (mode 700), isolated container filesystems, and the patched symlink-unlink guard in commit ad2d853.

The CVSS 4.0 score of 4.4 with vector AV:L/AC:L/AT:P/PR:L/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N reflects the primary risk moderators: local filesystem access is required, specific attack preconditions must be met (AT:P - shared-cache topology and predictable extraction output paths), and passive user interaction is needed (a legitimate extraction must be triggered). The high integrity and availability impacts on the vulnerable system are accurate given that arbitrary file overwrite is achievable. The publicly available POC meaningfully raises practical risk beyond what the moderate base score implies, particularly in multi-user ML infrastructure. No CISA KEV listing exists for this CVE and EPSS data was not provided, so exploitation breadth cannot be quantified. Real-world risk is concentrated in shared HPC clusters, containerized training pipelines with shared volume mounts, and automated data-processing services running as privileged users - in those contexts, this should be treated as higher priority than the 4.4 score suggests. In single-user workstations or properly isolated containers, risk is negligible. No conflicting data signals were identified; the CVSS vector is consistent with the described local symlink attack.

A low-privileged attacker on a shared ML training cluster identifies that a privileged data-ingestion service periodically calls Extractor.extract() using a cache directory writable by all cluster users. The attacker pre-plants a symlink at the predictable extraction output path pointing to /etc/cron.d/rootjob, then waits for the service to trigger its next scheduled dataset pull. When Extractor.extract() runs without the symlink check, archive contents are written through the symlink to the cron directory, injecting a root-level cron job. A public exploit demonstrating this path-redirection technique is available at https://github.com/huggingface/datasets/issues/8296.