datasets
🤗 The largest hub of ready-to-use datasets for AI models with fast, easy-to-use and efficient data manipulation tools
View on Github
Activity
- Latest release
- 3w ago
- Total releases
- 120
- Cadence
- ~17 days
- Last 12 months
- 16
Reach
- Stars
- 22.0k
Details
- License
- Apache-2.0
- First release
- Aug 18, 2015
| Version | Released | |
|---|---|---|
5.1.0
minor
| ||
5.0.1
patch
| ||
5.0.0
major
1 CVE
CVE-2026-66007
GHSA-379c-qx7v-6h59
PYSEC-2026-3716
Jul 24, 2026
Hugging Face Datasets folder-based builders allow path traversal through file_name metadata
Medium
Network
Low
None
Datasets through 5.0.0, fixed in f989ef9, contains a path traversal vulnerability in folder-based dataset builders where the file_name metadata field is not properly validated before being joined to the dataset directory. Attackers can supply crafted file_name values with directory traversal sequences to read arbitrary local files, which are then embedded into output when save_to_disk or push_to_hub is called. Affected versions
0.0.9
1.0.0
1.0.1
1.0.2
1.1.0
1.1.1
1.1.2
1.1.3
1.10.0
1.10.1
1.10.2
1.11.0
+ 106 more Show less
1.12.0
1.12.1
1.13.0
1.13.1
1.13.2
1.13.3
1.14.0
1.15.0
1.15.1
1.16.0
1.16.1
1.17.0
1.18.0
1.18.1
1.18.2
1.18.3
1.18.4
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.6.0
1.6.1
1.6.2
1.7.0
1.8.0
1.9.0
2.0.0
2.1.0
2.10.0
2.10.1
2.11.0
2.12.0
2.13.0
2.13.1
2.13.2
2.14.0
2.14.1
2.14.2
2.14.3
2.14.4
2.14.5
2.14.6
2.14.7
2.15.0
2.16.0
2.16.1
2.17.0
2.17.1
2.18.0
2.19.0
2.19.1
2.19.2
2.2.0
2.2.1
2.2.2
2.20.0
2.21.0
2.3.0
2.3.1
2.3.2
2.4.0
2.5.0
2.5.1
2.5.2
2.6.0
2.6.1
2.6.2
2.7.0
2.7.1
2.8.0
2.9.0
3.0.0
3.0.1
3.0.2
3.1.0
3.2.0
3.3.0
3.3.1
3.3.2
3.4.0
3.4.1
3.5.0
3.5.1
3.6.0
4.0.0
4.1.0
4.1.1
4.2.0
4.3.0
4.4.0
4.4.1
4.4.2
4.5.0
4.6.0
4.6.1
4.7.0
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
5.0.0
Fixed in
5.0.1
References
Updated Oct 02, 2026 · Source: OSV.dev | ||
4.8.5
patch
1 CVE
CVE-2026-66007
GHSA-379c-qx7v-6h59
PYSEC-2026-3716
Jul 24, 2026
Hugging Face Datasets folder-based builders allow path traversal through file_name metadata
Medium
Network
Low
None
Datasets through 5.0.0, fixed in f989ef9, contains a path traversal vulnerability in folder-based dataset builders where the file_name metadata field is not properly validated before being joined to the dataset directory. Attackers can supply crafted file_name values with directory traversal sequences to read arbitrary local files, which are then embedded into output when save_to_disk or push_to_hub is called. Affected versions
0.0.9
1.0.0
1.0.1
1.0.2
1.1.0
1.1.1
1.1.2
1.1.3
1.10.0
1.10.1
1.10.2
1.11.0
+ 106 more Show less
1.12.0
1.12.1
1.13.0
1.13.1
1.13.2
1.13.3
1.14.0
1.15.0
1.15.1
1.16.0
1.16.1
1.17.0
1.18.0
1.18.1
1.18.2
1.18.3
1.18.4
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.6.0
1.6.1
1.6.2
1.7.0
1.8.0
1.9.0
2.0.0
2.1.0
2.10.0
2.10.1
2.11.0
2.12.0
2.13.0
2.13.1
2.13.2
2.14.0
2.14.1
2.14.2
2.14.3
2.14.4
2.14.5
2.14.6
2.14.7
2.15.0
2.16.0
2.16.1
2.17.0
2.17.1
2.18.0
2.19.0
2.19.1
2.19.2
2.2.0
2.2.1
2.2.2
2.20.0
2.21.0
2.3.0
2.3.1
2.3.2
2.4.0
2.5.0
2.5.1
2.5.2
2.6.0
2.6.1
2.6.2
2.7.0
2.7.1
2.8.0
2.9.0
3.0.0
3.0.1
3.0.2
3.1.0
3.2.0
3.3.0
3.3.1
3.3.2
3.4.0
3.4.1
3.5.0
3.5.1
3.6.0
4.0.0
4.1.0
4.1.1
4.2.0
4.3.0
4.4.0
4.4.1
4.4.2
4.5.0
4.6.0
4.6.1
4.7.0
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
5.0.0
Fixed in
5.0.1
References
Updated Oct 02, 2026 · Source: OSV.dev | ||
4.8.4
patch
1 CVE
CVE-2026-66007
GHSA-379c-qx7v-6h59
PYSEC-2026-3716
Jul 24, 2026
Hugging Face Datasets folder-based builders allow path traversal through file_name metadata
Medium
Network
Low
None
Datasets through 5.0.0, fixed in f989ef9, contains a path traversal vulnerability in folder-based dataset builders where the file_name metadata field is not properly validated before being joined to the dataset directory. Attackers can supply crafted file_name values with directory traversal sequences to read arbitrary local files, which are then embedded into output when save_to_disk or push_to_hub is called. Affected versions
0.0.9
1.0.0
1.0.1
1.0.2
1.1.0
1.1.1
1.1.2
1.1.3
1.10.0
1.10.1
1.10.2
1.11.0
+ 106 more Show less
1.12.0
1.12.1
1.13.0
1.13.1
1.13.2
1.13.3
1.14.0
1.15.0
1.15.1
1.16.0
1.16.1
1.17.0
1.18.0
1.18.1
1.18.2
1.18.3
1.18.4
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.6.0
1.6.1
1.6.2
1.7.0
1.8.0
1.9.0
2.0.0
2.1.0
2.10.0
2.10.1
2.11.0
2.12.0
2.13.0
2.13.1
2.13.2
2.14.0
2.14.1
2.14.2
2.14.3
2.14.4
2.14.5
2.14.6
2.14.7
2.15.0
2.16.0
2.16.1
2.17.0
2.17.1
2.18.0
2.19.0
2.19.1
2.19.2
2.2.0
2.2.1
2.2.2
2.20.0
2.21.0
2.3.0
2.3.1
2.3.2
2.4.0
2.5.0
2.5.1
2.5.2
2.6.0
2.6.1
2.6.2
2.7.0
2.7.1
2.8.0
2.9.0
3.0.0
3.0.1
3.0.2
3.1.0
3.2.0
3.3.0
3.3.1
3.3.2
3.4.0
3.4.1
3.5.0
3.5.1
3.6.0
4.0.0
4.1.0
4.1.1
4.2.0
4.3.0
4.4.0
4.4.1
4.4.2
4.5.0
4.6.0
4.6.1
4.7.0
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
5.0.0
Fixed in
5.0.1
References
Updated Oct 02, 2026 · Source: OSV.dev | ||
4.8.3
patch
1 CVE
CVE-2026-66007
GHSA-379c-qx7v-6h59
PYSEC-2026-3716
Jul 24, 2026
Hugging Face Datasets folder-based builders allow path traversal through file_name metadata
Medium
Network
Low
None
Datasets through 5.0.0, fixed in f989ef9, contains a path traversal vulnerability in folder-based dataset builders where the file_name metadata field is not properly validated before being joined to the dataset directory. Attackers can supply crafted file_name values with directory traversal sequences to read arbitrary local files, which are then embedded into output when save_to_disk or push_to_hub is called. Affected versions
0.0.9
1.0.0
1.0.1
1.0.2
1.1.0
1.1.1
1.1.2
1.1.3
1.10.0
1.10.1
1.10.2
1.11.0
+ 106 more Show less
1.12.0
1.12.1
1.13.0
1.13.1
1.13.2
1.13.3
1.14.0
1.15.0
1.15.1
1.16.0
1.16.1
1.17.0
1.18.0
1.18.1
1.18.2
1.18.3
1.18.4
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.6.0
1.6.1
1.6.2
1.7.0
1.8.0
1.9.0
2.0.0
2.1.0
2.10.0
2.10.1
2.11.0
2.12.0
2.13.0
2.13.1
2.13.2
2.14.0
2.14.1
2.14.2
2.14.3
2.14.4
2.14.5
2.14.6
2.14.7
2.15.0
2.16.0
2.16.1
2.17.0
2.17.1
2.18.0
2.19.0
2.19.1
2.19.2
2.2.0
2.2.1
2.2.2
2.20.0
2.21.0
2.3.0
2.3.1
2.3.2
2.4.0
2.5.0
2.5.1
2.5.2
2.6.0
2.6.1
2.6.2
2.7.0
2.7.1
2.8.0
2.9.0
3.0.0
3.0.1
3.0.2
3.1.0
3.2.0
3.3.0
3.3.1
3.3.2
3.4.0
3.4.1
3.5.0
3.5.1
3.6.0
4.0.0
4.1.0
4.1.1
4.2.0
4.3.0
4.4.0
4.4.1
4.4.2
4.5.0
4.6.0
4.6.1
4.7.0
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
5.0.0
Fixed in
5.0.1
References
Updated Oct 02, 2026 · Source: OSV.dev | ||
4.8.2
patch
1 CVE
CVE-2026-66007
GHSA-379c-qx7v-6h59
PYSEC-2026-3716
Jul 24, 2026
Hugging Face Datasets folder-based builders allow path traversal through file_name metadata
Medium
Network
Low
None
Datasets through 5.0.0, fixed in f989ef9, contains a path traversal vulnerability in folder-based dataset builders where the file_name metadata field is not properly validated before being joined to the dataset directory. Attackers can supply crafted file_name values with directory traversal sequences to read arbitrary local files, which are then embedded into output when save_to_disk or push_to_hub is called. Affected versions
0.0.9
1.0.0
1.0.1
1.0.2
1.1.0
1.1.1
1.1.2
1.1.3
1.10.0
1.10.1
1.10.2
1.11.0
+ 106 more Show less
1.12.0
1.12.1
1.13.0
1.13.1
1.13.2
1.13.3
1.14.0
1.15.0
1.15.1
1.16.0
1.16.1
1.17.0
1.18.0
1.18.1
1.18.2
1.18.3
1.18.4
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.6.0
1.6.1
1.6.2
1.7.0
1.8.0
1.9.0
2.0.0
2.1.0
2.10.0
2.10.1
2.11.0
2.12.0
2.13.0
2.13.1
2.13.2
2.14.0
2.14.1
2.14.2
2.14.3
2.14.4
2.14.5
2.14.6
2.14.7
2.15.0
2.16.0
2.16.1
2.17.0
2.17.1
2.18.0
2.19.0
2.19.1
2.19.2
2.2.0
2.2.1
2.2.2
2.20.0
2.21.0
2.3.0
2.3.1
2.3.2
2.4.0
2.5.0
2.5.1
2.5.2
2.6.0
2.6.1
2.6.2
2.7.0
2.7.1
2.8.0
2.9.0
3.0.0
3.0.1
3.0.2
3.1.0
3.2.0
3.3.0
3.3.1
3.3.2
3.4.0
3.4.1
3.5.0
3.5.1
3.6.0
4.0.0
4.1.0
4.1.1
4.2.0
4.3.0
4.4.0
4.4.1
4.4.2
4.5.0
4.6.0
4.6.1
4.7.0
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
5.0.0
Fixed in
5.0.1
References
Updated Oct 02, 2026 · Source: OSV.dev | ||
4.8.1
patch
1 CVE
CVE-2026-66007
GHSA-379c-qx7v-6h59
PYSEC-2026-3716
Jul 24, 2026
Hugging Face Datasets folder-based builders allow path traversal through file_name metadata
Medium
Network
Low
None
Datasets through 5.0.0, fixed in f989ef9, contains a path traversal vulnerability in folder-based dataset builders where the file_name metadata field is not properly validated before being joined to the dataset directory. Attackers can supply crafted file_name values with directory traversal sequences to read arbitrary local files, which are then embedded into output when save_to_disk or push_to_hub is called. Affected versions
0.0.9
1.0.0
1.0.1
1.0.2
1.1.0
1.1.1
1.1.2
1.1.3
1.10.0
1.10.1
1.10.2
1.11.0
+ 106 more Show less
1.12.0
1.12.1
1.13.0
1.13.1
1.13.2
1.13.3
1.14.0
1.15.0
1.15.1
1.16.0
1.16.1
1.17.0
1.18.0
1.18.1
1.18.2
1.18.3
1.18.4
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.6.0
1.6.1
1.6.2
1.7.0
1.8.0
1.9.0
2.0.0
2.1.0
2.10.0
2.10.1
2.11.0
2.12.0
2.13.0
2.13.1
2.13.2
2.14.0
2.14.1
2.14.2
2.14.3
2.14.4
2.14.5
2.14.6
2.14.7
2.15.0
2.16.0
2.16.1
2.17.0
2.17.1
2.18.0
2.19.0
2.19.1
2.19.2
2.2.0
2.2.1
2.2.2
2.20.0
2.21.0
2.3.0
2.3.1
2.3.2
2.4.0
2.5.0
2.5.1
2.5.2
2.6.0
2.6.1
2.6.2
2.7.0
2.7.1
2.8.0
2.9.0
3.0.0
3.0.1
3.0.2
3.1.0
3.2.0
3.3.0
3.3.1
3.3.2
3.4.0
3.4.1
3.5.0
3.5.1
3.6.0
4.0.0
4.1.0
4.1.1
4.2.0
4.3.0
4.4.0
4.4.1
4.4.2
4.5.0
4.6.0
4.6.1
4.7.0
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
5.0.0
Fixed in
5.0.1
References
Updated Oct 02, 2026 · Source: OSV.dev | ||
4.8.0
minor
1 CVE
CVE-2026-66007
GHSA-379c-qx7v-6h59
PYSEC-2026-3716
Jul 24, 2026
Hugging Face Datasets folder-based builders allow path traversal through file_name metadata
Medium
Network
Low
None
Datasets through 5.0.0, fixed in f989ef9, contains a path traversal vulnerability in folder-based dataset builders where the file_name metadata field is not properly validated before being joined to the dataset directory. Attackers can supply crafted file_name values with directory traversal sequences to read arbitrary local files, which are then embedded into output when save_to_disk or push_to_hub is called. Affected versions
0.0.9
1.0.0
1.0.1
1.0.2
1.1.0
1.1.1
1.1.2
1.1.3
1.10.0
1.10.1
1.10.2
1.11.0
+ 106 more Show less
1.12.0
1.12.1
1.13.0
1.13.1
1.13.2
1.13.3
1.14.0
1.15.0
1.15.1
1.16.0
1.16.1
1.17.0
1.18.0
1.18.1
1.18.2
1.18.3
1.18.4
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.6.0
1.6.1
1.6.2
1.7.0
1.8.0
1.9.0
2.0.0
2.1.0
2.10.0
2.10.1
2.11.0
2.12.0
2.13.0
2.13.1
2.13.2
2.14.0
2.14.1
2.14.2
2.14.3
2.14.4
2.14.5
2.14.6
2.14.7
2.15.0
2.16.0
2.16.1
2.17.0
2.17.1
2.18.0
2.19.0
2.19.1
2.19.2
2.2.0
2.2.1
2.2.2
2.20.0
2.21.0
2.3.0
2.3.1
2.3.2
2.4.0
2.5.0
2.5.1
2.5.2
2.6.0
2.6.1
2.6.2
2.7.0
2.7.1
2.8.0
2.9.0
3.0.0
3.0.1
3.0.2
3.1.0
3.2.0
3.3.0
3.3.1
3.3.2
3.4.0
3.4.1
3.5.0
3.5.1
3.6.0
4.0.0
4.1.0
4.1.1
4.2.0
4.3.0
4.4.0
4.4.1
4.4.2
4.5.0
4.6.0
4.6.1
4.7.0
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
5.0.0
Fixed in
5.0.1
References
Updated Oct 02, 2026 · Source: OSV.dev | ||
4.7.0
minor
1 CVE
CVE-2026-66007
GHSA-379c-qx7v-6h59
PYSEC-2026-3716
Jul 24, 2026
Hugging Face Datasets folder-based builders allow path traversal through file_name metadata
Medium
Network
Low
None
Datasets through 5.0.0, fixed in f989ef9, contains a path traversal vulnerability in folder-based dataset builders where the file_name metadata field is not properly validated before being joined to the dataset directory. Attackers can supply crafted file_name values with directory traversal sequences to read arbitrary local files, which are then embedded into output when save_to_disk or push_to_hub is called. Affected versions
0.0.9
1.0.0
1.0.1
1.0.2
1.1.0
1.1.1
1.1.2
1.1.3
1.10.0
1.10.1
1.10.2
1.11.0
+ 106 more Show less
1.12.0
1.12.1
1.13.0
1.13.1
1.13.2
1.13.3
1.14.0
1.15.0
1.15.1
1.16.0
1.16.1
1.17.0
1.18.0
1.18.1
1.18.2
1.18.3
1.18.4
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.6.0
1.6.1
1.6.2
1.7.0
1.8.0
1.9.0
2.0.0
2.1.0
2.10.0
2.10.1
2.11.0
2.12.0
2.13.0
2.13.1
2.13.2
2.14.0
2.14.1
2.14.2
2.14.3
2.14.4
2.14.5
2.14.6
2.14.7
2.15.0
2.16.0
2.16.1
2.17.0
2.17.1
2.18.0
2.19.0
2.19.1
2.19.2
2.2.0
2.2.1
2.2.2
2.20.0
2.21.0
2.3.0
2.3.1
2.3.2
2.4.0
2.5.0
2.5.1
2.5.2
2.6.0
2.6.1
2.6.2
2.7.0
2.7.1
2.8.0
2.9.0
3.0.0
3.0.1
3.0.2
3.1.0
3.2.0
3.3.0
3.3.1
3.3.2
3.4.0
3.4.1
3.5.0
3.5.1
3.6.0
4.0.0
4.1.0
4.1.1
4.2.0
4.3.0
4.4.0
4.4.1
4.4.2
4.5.0
4.6.0
4.6.1
4.7.0
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
5.0.0
Fixed in
5.0.1
References
Updated Oct 02, 2026 · Source: OSV.dev | ||
4.6.1
patch
1 CVE
CVE-2026-66007
GHSA-379c-qx7v-6h59
PYSEC-2026-3716
Jul 24, 2026
Hugging Face Datasets folder-based builders allow path traversal through file_name metadata
Medium
Network
Low
None
Datasets through 5.0.0, fixed in f989ef9, contains a path traversal vulnerability in folder-based dataset builders where the file_name metadata field is not properly validated before being joined to the dataset directory. Attackers can supply crafted file_name values with directory traversal sequences to read arbitrary local files, which are then embedded into output when save_to_disk or push_to_hub is called. Affected versions
0.0.9
1.0.0
1.0.1
1.0.2
1.1.0
1.1.1
1.1.2
1.1.3
1.10.0
1.10.1
1.10.2
1.11.0
+ 106 more Show less
1.12.0
1.12.1
1.13.0
1.13.1
1.13.2
1.13.3
1.14.0
1.15.0
1.15.1
1.16.0
1.16.1
1.17.0
1.18.0
1.18.1
1.18.2
1.18.3
1.18.4
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.6.0
1.6.1
1.6.2
1.7.0
1.8.0
1.9.0
2.0.0
2.1.0
2.10.0
2.10.1
2.11.0
2.12.0
2.13.0
2.13.1
2.13.2
2.14.0
2.14.1
2.14.2
2.14.3
2.14.4
2.14.5
2.14.6
2.14.7
2.15.0
2.16.0
2.16.1
2.17.0
2.17.1
2.18.0
2.19.0
2.19.1
2.19.2
2.2.0
2.2.1
2.2.2
2.20.0
2.21.0
2.3.0
2.3.1
2.3.2
2.4.0
2.5.0
2.5.1
2.5.2
2.6.0
2.6.1
2.6.2
2.7.0
2.7.1
2.8.0
2.9.0
3.0.0
3.0.1
3.0.2
3.1.0
3.2.0
3.3.0
3.3.1
3.3.2
3.4.0
3.4.1
3.5.0
3.5.1
3.6.0
4.0.0
4.1.0
4.1.1
4.2.0
4.3.0
4.4.0
4.4.1
4.4.2
4.5.0
4.6.0
4.6.1
4.7.0
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
5.0.0
Fixed in
5.0.1
References
Updated Oct 02, 2026 · Source: OSV.dev | ||
4.6.0
minor
1 CVE
CVE-2026-66007
GHSA-379c-qx7v-6h59
PYSEC-2026-3716
Jul 24, 2026
Hugging Face Datasets folder-based builders allow path traversal through file_name metadata
Medium
Network
Low
None
Datasets through 5.0.0, fixed in f989ef9, contains a path traversal vulnerability in folder-based dataset builders where the file_name metadata field is not properly validated before being joined to the dataset directory. Attackers can supply crafted file_name values with directory traversal sequences to read arbitrary local files, which are then embedded into output when save_to_disk or push_to_hub is called. Affected versions
0.0.9
1.0.0
1.0.1
1.0.2
1.1.0
1.1.1
1.1.2
1.1.3
1.10.0
1.10.1
1.10.2
1.11.0
+ 106 more Show less
1.12.0
1.12.1
1.13.0
1.13.1
1.13.2
1.13.3
1.14.0
1.15.0
1.15.1
1.16.0
1.16.1
1.17.0
1.18.0
1.18.1
1.18.2
1.18.3
1.18.4
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.6.0
1.6.1
1.6.2
1.7.0
1.8.0
1.9.0
2.0.0
2.1.0
2.10.0
2.10.1
2.11.0
2.12.0
2.13.0
2.13.1
2.13.2
2.14.0
2.14.1
2.14.2
2.14.3
2.14.4
2.14.5
2.14.6
2.14.7
2.15.0
2.16.0
2.16.1
2.17.0
2.17.1
2.18.0
2.19.0
2.19.1
2.19.2
2.2.0
2.2.1
2.2.2
2.20.0
2.21.0
2.3.0
2.3.1
2.3.2
2.4.0
2.5.0
2.5.1
2.5.2
2.6.0
2.6.1
2.6.2
2.7.0
2.7.1
2.8.0
2.9.0
3.0.0
3.0.1
3.0.2
3.1.0
3.2.0
3.3.0
3.3.1
3.3.2
3.4.0
3.4.1
3.5.0
3.5.1
3.6.0
4.0.0
4.1.0
4.1.1
4.2.0
4.3.0
4.4.0
4.4.1
4.4.2
4.5.0
4.6.0
4.6.1
4.7.0
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
5.0.0
Fixed in
5.0.1
References
Updated Oct 02, 2026 · Source: OSV.dev | ||
4.5.0
minor
1 CVE
CVE-2026-66007
GHSA-379c-qx7v-6h59
PYSEC-2026-3716
Jul 24, 2026
Hugging Face Datasets folder-based builders allow path traversal through file_name metadata
Medium
Network
Low
None
Datasets through 5.0.0, fixed in f989ef9, contains a path traversal vulnerability in folder-based dataset builders where the file_name metadata field is not properly validated before being joined to the dataset directory. Attackers can supply crafted file_name values with directory traversal sequences to read arbitrary local files, which are then embedded into output when save_to_disk or push_to_hub is called. Affected versions
0.0.9
1.0.0
1.0.1
1.0.2
1.1.0
1.1.1
1.1.2
1.1.3
1.10.0
1.10.1
1.10.2
1.11.0
+ 106 more Show less
1.12.0
1.12.1
1.13.0
1.13.1
1.13.2
1.13.3
1.14.0
1.15.0
1.15.1
1.16.0
1.16.1
1.17.0
1.18.0
1.18.1
1.18.2
1.18.3
1.18.4
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.6.0
1.6.1
1.6.2
1.7.0
1.8.0
1.9.0
2.0.0
2.1.0
2.10.0
2.10.1
2.11.0
2.12.0
2.13.0
2.13.1
2.13.2
2.14.0
2.14.1
2.14.2
2.14.3
2.14.4
2.14.5
2.14.6
2.14.7
2.15.0
2.16.0
2.16.1
2.17.0
2.17.1
2.18.0
2.19.0
2.19.1
2.19.2
2.2.0
2.2.1
2.2.2
2.20.0
2.21.0
2.3.0
2.3.1
2.3.2
2.4.0
2.5.0
2.5.1
2.5.2
2.6.0
2.6.1
2.6.2
2.7.0
2.7.1
2.8.0
2.9.0
3.0.0
3.0.1
3.0.2
3.1.0
3.2.0
3.3.0
3.3.1
3.3.2
3.4.0
3.4.1
3.5.0
3.5.1
3.6.0
4.0.0
4.1.0
4.1.1
4.2.0
4.3.0
4.4.0
4.4.1
4.4.2
4.5.0
4.6.0
4.6.1
4.7.0
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
5.0.0
Fixed in
5.0.1
References
Updated Oct 02, 2026 · Source: OSV.dev | ||
4.4.2
patch
1 CVE
CVE-2026-66007
GHSA-379c-qx7v-6h59
PYSEC-2026-3716
Jul 24, 2026
Hugging Face Datasets folder-based builders allow path traversal through file_name metadata
Medium
Network
Low
None
Datasets through 5.0.0, fixed in f989ef9, contains a path traversal vulnerability in folder-based dataset builders where the file_name metadata field is not properly validated before being joined to the dataset directory. Attackers can supply crafted file_name values with directory traversal sequences to read arbitrary local files, which are then embedded into output when save_to_disk or push_to_hub is called. Affected versions
0.0.9
1.0.0
1.0.1
1.0.2
1.1.0
1.1.1
1.1.2
1.1.3
1.10.0
1.10.1
1.10.2
1.11.0
+ 106 more Show less
1.12.0
1.12.1
1.13.0
1.13.1
1.13.2
1.13.3
1.14.0
1.15.0
1.15.1
1.16.0
1.16.1
1.17.0
1.18.0
1.18.1
1.18.2
1.18.3
1.18.4
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.6.0
1.6.1
1.6.2
1.7.0
1.8.0
1.9.0
2.0.0
2.1.0
2.10.0
2.10.1
2.11.0
2.12.0
2.13.0
2.13.1
2.13.2
2.14.0
2.14.1
2.14.2
2.14.3
2.14.4
2.14.5
2.14.6
2.14.7
2.15.0
2.16.0
2.16.1
2.17.0
2.17.1
2.18.0
2.19.0
2.19.1
2.19.2
2.2.0
2.2.1
2.2.2
2.20.0
2.21.0
2.3.0
2.3.1
2.3.2
2.4.0
2.5.0
2.5.1
2.5.2
2.6.0
2.6.1
2.6.2
2.7.0
2.7.1
2.8.0
2.9.0
3.0.0
3.0.1
3.0.2
3.1.0
3.2.0
3.3.0
3.3.1
3.3.2
3.4.0
3.4.1
3.5.0
3.5.1
3.6.0
4.0.0
4.1.0
4.1.1
4.2.0
4.3.0
4.4.0
4.4.1
4.4.2
4.5.0
4.6.0
4.6.1
4.7.0
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
5.0.0
Fixed in
5.0.1
References
Updated Oct 02, 2026 · Source: OSV.dev | ||
4.4.1
patch
1 CVE
CVE-2026-66007
GHSA-379c-qx7v-6h59
PYSEC-2026-3716
Jul 24, 2026
Hugging Face Datasets folder-based builders allow path traversal through file_name metadata
Medium
Network
Low
None
Datasets through 5.0.0, fixed in f989ef9, contains a path traversal vulnerability in folder-based dataset builders where the file_name metadata field is not properly validated before being joined to the dataset directory. Attackers can supply crafted file_name values with directory traversal sequences to read arbitrary local files, which are then embedded into output when save_to_disk or push_to_hub is called. Affected versions
0.0.9
1.0.0
1.0.1
1.0.2
1.1.0
1.1.1
1.1.2
1.1.3
1.10.0
1.10.1
1.10.2
1.11.0
+ 106 more Show less
1.12.0
1.12.1
1.13.0
1.13.1
1.13.2
1.13.3
1.14.0
1.15.0
1.15.1
1.16.0
1.16.1
1.17.0
1.18.0
1.18.1
1.18.2
1.18.3
1.18.4
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.6.0
1.6.1
1.6.2
1.7.0
1.8.0
1.9.0
2.0.0
2.1.0
2.10.0
2.10.1
2.11.0
2.12.0
2.13.0
2.13.1
2.13.2
2.14.0
2.14.1
2.14.2
2.14.3
2.14.4
2.14.5
2.14.6
2.14.7
2.15.0
2.16.0
2.16.1
2.17.0
2.17.1
2.18.0
2.19.0
2.19.1
2.19.2
2.2.0
2.2.1
2.2.2
2.20.0
2.21.0
2.3.0
2.3.1
2.3.2
2.4.0
2.5.0
2.5.1
2.5.2
2.6.0
2.6.1
2.6.2
2.7.0
2.7.1
2.8.0
2.9.0
3.0.0
3.0.1
3.0.2
3.1.0
3.2.0
3.3.0
3.3.1
3.3.2
3.4.0
3.4.1
3.5.0
3.5.1
3.6.0
4.0.0
4.1.0
4.1.1
4.2.0
4.3.0
4.4.0
4.4.1
4.4.2
4.5.0
4.6.0
4.6.1
4.7.0
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
5.0.0
Fixed in
5.0.1
References
Updated Oct 02, 2026 · Source: OSV.dev | ||
4.4.0
minor
1 CVE
CVE-2026-66007
GHSA-379c-qx7v-6h59
PYSEC-2026-3716
Jul 24, 2026
Hugging Face Datasets folder-based builders allow path traversal through file_name metadata
Medium
Network
Low
None
Datasets through 5.0.0, fixed in f989ef9, contains a path traversal vulnerability in folder-based dataset builders where the file_name metadata field is not properly validated before being joined to the dataset directory. Attackers can supply crafted file_name values with directory traversal sequences to read arbitrary local files, which are then embedded into output when save_to_disk or push_to_hub is called. Affected versions
0.0.9
1.0.0
1.0.1
1.0.2
1.1.0
1.1.1
1.1.2
1.1.3
1.10.0
1.10.1
1.10.2
1.11.0
+ 106 more Show less
1.12.0
1.12.1
1.13.0
1.13.1
1.13.2
1.13.3
1.14.0
1.15.0
1.15.1
1.16.0
1.16.1
1.17.0
1.18.0
1.18.1
1.18.2
1.18.3
1.18.4
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.6.0
1.6.1
1.6.2
1.7.0
1.8.0
1.9.0
2.0.0
2.1.0
2.10.0
2.10.1
2.11.0
2.12.0
2.13.0
2.13.1
2.13.2
2.14.0
2.14.1
2.14.2
2.14.3
2.14.4
2.14.5
2.14.6
2.14.7
2.15.0
2.16.0
2.16.1
2.17.0
2.17.1
2.18.0
2.19.0
2.19.1
2.19.2
2.2.0
2.2.1
2.2.2
2.20.0
2.21.0
2.3.0
2.3.1
2.3.2
2.4.0
2.5.0
2.5.1
2.5.2
2.6.0
2.6.1
2.6.2
2.7.0
2.7.1
2.8.0
2.9.0
3.0.0
3.0.1
3.0.2
3.1.0
3.2.0
3.3.0
3.3.1
3.3.2
3.4.0
3.4.1
3.5.0
3.5.1
3.6.0
4.0.0
4.1.0
4.1.1
4.2.0
4.3.0
4.4.0
4.4.1
4.4.2
4.5.0
4.6.0
4.6.1
4.7.0
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
5.0.0
Fixed in
5.0.1
References
Updated Oct 02, 2026 · Source: OSV.dev | ||
4.3.0
minor
1 CVE
CVE-2026-66007
GHSA-379c-qx7v-6h59
PYSEC-2026-3716
Jul 24, 2026
Hugging Face Datasets folder-based builders allow path traversal through file_name metadata
Medium
Network
Low
None
Datasets through 5.0.0, fixed in f989ef9, contains a path traversal vulnerability in folder-based dataset builders where the file_name metadata field is not properly validated before being joined to the dataset directory. Attackers can supply crafted file_name values with directory traversal sequences to read arbitrary local files, which are then embedded into output when save_to_disk or push_to_hub is called. Affected versions
0.0.9
1.0.0
1.0.1
1.0.2
1.1.0
1.1.1
1.1.2
1.1.3
1.10.0
1.10.1
1.10.2
1.11.0
+ 106 more Show less
1.12.0
1.12.1
1.13.0
1.13.1
1.13.2
1.13.3
1.14.0
1.15.0
1.15.1
1.16.0
1.16.1
1.17.0
1.18.0
1.18.1
1.18.2
1.18.3
1.18.4
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.6.0
1.6.1
1.6.2
1.7.0
1.8.0
1.9.0
2.0.0
2.1.0
2.10.0
2.10.1
2.11.0
2.12.0
2.13.0
2.13.1
2.13.2
2.14.0
2.14.1
2.14.2
2.14.3
2.14.4
2.14.5
2.14.6
2.14.7
2.15.0
2.16.0
2.16.1
2.17.0
2.17.1
2.18.0
2.19.0
2.19.1
2.19.2
2.2.0
2.2.1
2.2.2
2.20.0
2.21.0
2.3.0
2.3.1
2.3.2
2.4.0
2.5.0
2.5.1
2.5.2
2.6.0
2.6.1
2.6.2
2.7.0
2.7.1
2.8.0
2.9.0
3.0.0
3.0.1
3.0.2
3.1.0
3.2.0
3.3.0
3.3.1
3.3.2
3.4.0
3.4.1
3.5.0
3.5.1
3.6.0
4.0.0
4.1.0
4.1.1
4.2.0
4.3.0
4.4.0
4.4.1
4.4.2
4.5.0
4.6.0
4.6.1
4.7.0
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
5.0.0
Fixed in
5.0.1
References
Updated Oct 02, 2026 · Source: OSV.dev | ||
4.2.0
minor
1 CVE
CVE-2026-66007
GHSA-379c-qx7v-6h59
PYSEC-2026-3716
Jul 24, 2026
Hugging Face Datasets folder-based builders allow path traversal through file_name metadata
Medium
Network
Low
None
Datasets through 5.0.0, fixed in f989ef9, contains a path traversal vulnerability in folder-based dataset builders where the file_name metadata field is not properly validated before being joined to the dataset directory. Attackers can supply crafted file_name values with directory traversal sequences to read arbitrary local files, which are then embedded into output when save_to_disk or push_to_hub is called. Affected versions
0.0.9
1.0.0
1.0.1
1.0.2
1.1.0
1.1.1
1.1.2
1.1.3
1.10.0
1.10.1
1.10.2
1.11.0
+ 106 more Show less
1.12.0
1.12.1
1.13.0
1.13.1
1.13.2
1.13.3
1.14.0
1.15.0
1.15.1
1.16.0
1.16.1
1.17.0
1.18.0
1.18.1
1.18.2
1.18.3
1.18.4
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.6.0
1.6.1
1.6.2
1.7.0
1.8.0
1.9.0
2.0.0
2.1.0
2.10.0
2.10.1
2.11.0
2.12.0
2.13.0
2.13.1
2.13.2
2.14.0
2.14.1
2.14.2
2.14.3
2.14.4
2.14.5
2.14.6
2.14.7
2.15.0
2.16.0
2.16.1
2.17.0
2.17.1
2.18.0
2.19.0
2.19.1
2.19.2
2.2.0
2.2.1
2.2.2
2.20.0
2.21.0
2.3.0
2.3.1
2.3.2
2.4.0
2.5.0
2.5.1
2.5.2
2.6.0
2.6.1
2.6.2
2.7.0
2.7.1
2.8.0
2.9.0
3.0.0
3.0.1
3.0.2
3.1.0
3.2.0
3.3.0
3.3.1
3.3.2
3.4.0
3.4.1
3.5.0
3.5.1
3.6.0
4.0.0
4.1.0
4.1.1
4.2.0
4.3.0
4.4.0
4.4.1
4.4.2
4.5.0
4.6.0
4.6.1
4.7.0
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
5.0.0
Fixed in
5.0.1
References
Updated Oct 02, 2026 · Source: OSV.dev | ||
4.1.1
patch
1 CVE
CVE-2026-66007
GHSA-379c-qx7v-6h59
PYSEC-2026-3716
Jul 24, 2026
Hugging Face Datasets folder-based builders allow path traversal through file_name metadata
Medium
Network
Low
None
Datasets through 5.0.0, fixed in f989ef9, contains a path traversal vulnerability in folder-based dataset builders where the file_name metadata field is not properly validated before being joined to the dataset directory. Attackers can supply crafted file_name values with directory traversal sequences to read arbitrary local files, which are then embedded into output when save_to_disk or push_to_hub is called. Affected versions
0.0.9
1.0.0
1.0.1
1.0.2
1.1.0
1.1.1
1.1.2
1.1.3
1.10.0
1.10.1
1.10.2
1.11.0
+ 106 more Show less
1.12.0
1.12.1
1.13.0
1.13.1
1.13.2
1.13.3
1.14.0
1.15.0
1.15.1
1.16.0
1.16.1
1.17.0
1.18.0
1.18.1
1.18.2
1.18.3
1.18.4
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.6.0
1.6.1
1.6.2
1.7.0
1.8.0
1.9.0
2.0.0
2.1.0
2.10.0
2.10.1
2.11.0
2.12.0
2.13.0
2.13.1
2.13.2
2.14.0
2.14.1
2.14.2
2.14.3
2.14.4
2.14.5
2.14.6
2.14.7
2.15.0
2.16.0
2.16.1
2.17.0
2.17.1
2.18.0
2.19.0
2.19.1
2.19.2
2.2.0
2.2.1
2.2.2
2.20.0
2.21.0
2.3.0
2.3.1
2.3.2
2.4.0
2.5.0
2.5.1
2.5.2
2.6.0
2.6.1
2.6.2
2.7.0
2.7.1
2.8.0
2.9.0
3.0.0
3.0.1
3.0.2
3.1.0
3.2.0
3.3.0
3.3.1
3.3.2
3.4.0
3.4.1
3.5.0
3.5.1
3.6.0
4.0.0
4.1.0
4.1.1
4.2.0
4.3.0
4.4.0
4.4.1
4.4.2
4.5.0
4.6.0
4.6.1
4.7.0
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
5.0.0
Fixed in
5.0.1
References
Updated Oct 02, 2026 · Source: OSV.dev | ||
4.1.0
minor
1 CVE
CVE-2026-66007
GHSA-379c-qx7v-6h59
PYSEC-2026-3716
Jul 24, 2026
Hugging Face Datasets folder-based builders allow path traversal through file_name metadata
Medium
Network
Low
None
Datasets through 5.0.0, fixed in f989ef9, contains a path traversal vulnerability in folder-based dataset builders where the file_name metadata field is not properly validated before being joined to the dataset directory. Attackers can supply crafted file_name values with directory traversal sequences to read arbitrary local files, which are then embedded into output when save_to_disk or push_to_hub is called. Affected versions
0.0.9
1.0.0
1.0.1
1.0.2
1.1.0
1.1.1
1.1.2
1.1.3
1.10.0
1.10.1
1.10.2
1.11.0
+ 106 more Show less
1.12.0
1.12.1
1.13.0
1.13.1
1.13.2
1.13.3
1.14.0
1.15.0
1.15.1
1.16.0
1.16.1
1.17.0
1.18.0
1.18.1
1.18.2
1.18.3
1.18.4
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.6.0
1.6.1
1.6.2
1.7.0
1.8.0
1.9.0
2.0.0
2.1.0
2.10.0
2.10.1
2.11.0
2.12.0
2.13.0
2.13.1
2.13.2
2.14.0
2.14.1
2.14.2
2.14.3
2.14.4
2.14.5
2.14.6
2.14.7
2.15.0
2.16.0
2.16.1
2.17.0
2.17.1
2.18.0
2.19.0
2.19.1
2.19.2
2.2.0
2.2.1
2.2.2
2.20.0
2.21.0
2.3.0
2.3.1
2.3.2
2.4.0
2.5.0
2.5.1
2.5.2
2.6.0
2.6.1
2.6.2
2.7.0
2.7.1
2.8.0
2.9.0
3.0.0
3.0.1
3.0.2
3.1.0
3.2.0
3.3.0
3.3.1
3.3.2
3.4.0
3.4.1
3.5.0
3.5.1
3.6.0
4.0.0
4.1.0
4.1.1
4.2.0
4.3.0
4.4.0
4.4.1
4.4.2
4.5.0
4.6.0
4.6.1
4.7.0
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
5.0.0
Fixed in
5.0.1
References
Updated Oct 02, 2026 · Source: OSV.dev | ||
4.0.0
major
1 CVE
CVE-2026-66007
GHSA-379c-qx7v-6h59
PYSEC-2026-3716
Jul 24, 2026
Hugging Face Datasets folder-based builders allow path traversal through file_name metadata
Medium
Network
Low
None
Datasets through 5.0.0, fixed in f989ef9, contains a path traversal vulnerability in folder-based dataset builders where the file_name metadata field is not properly validated before being joined to the dataset directory. Attackers can supply crafted file_name values with directory traversal sequences to read arbitrary local files, which are then embedded into output when save_to_disk or push_to_hub is called. Affected versions
0.0.9
1.0.0
1.0.1
1.0.2
1.1.0
1.1.1
1.1.2
1.1.3
1.10.0
1.10.1
1.10.2
1.11.0
+ 106 more Show less
1.12.0
1.12.1
1.13.0
1.13.1
1.13.2
1.13.3
1.14.0
1.15.0
1.15.1
1.16.0
1.16.1
1.17.0
1.18.0
1.18.1
1.18.2
1.18.3
1.18.4
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.6.0
1.6.1
1.6.2
1.7.0
1.8.0
1.9.0
2.0.0
2.1.0
2.10.0
2.10.1
2.11.0
2.12.0
2.13.0
2.13.1
2.13.2
2.14.0
2.14.1
2.14.2
2.14.3
2.14.4
2.14.5
2.14.6
2.14.7
2.15.0
2.16.0
2.16.1
2.17.0
2.17.1
2.18.0
2.19.0
2.19.1
2.19.2
2.2.0
2.2.1
2.2.2
2.20.0
2.21.0
2.3.0
2.3.1
2.3.2
2.4.0
2.5.0
2.5.1
2.5.2
2.6.0
2.6.1
2.6.2
2.7.0
2.7.1
2.8.0
2.9.0
3.0.0
3.0.1
3.0.2
3.1.0
3.2.0
3.3.0
3.3.1
3.3.2
3.4.0
3.4.1
3.5.0
3.5.1
3.6.0
4.0.0
4.1.0
4.1.1
4.2.0
4.3.0
4.4.0
4.4.1
4.4.2
4.5.0
4.6.0
4.6.1
4.7.0
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
5.0.0
Fixed in
5.0.1
References
Updated Oct 02, 2026 · Source: OSV.dev | ||
3.6.0
minor
1 CVE
CVE-2026-66007
GHSA-379c-qx7v-6h59
PYSEC-2026-3716
Jul 24, 2026
Hugging Face Datasets folder-based builders allow path traversal through file_name metadata
Medium
Network
Low
None
Datasets through 5.0.0, fixed in f989ef9, contains a path traversal vulnerability in folder-based dataset builders where the file_name metadata field is not properly validated before being joined to the dataset directory. Attackers can supply crafted file_name values with directory traversal sequences to read arbitrary local files, which are then embedded into output when save_to_disk or push_to_hub is called. Affected versions
0.0.9
1.0.0
1.0.1
1.0.2
1.1.0
1.1.1
1.1.2
1.1.3
1.10.0
1.10.1
1.10.2
1.11.0
+ 106 more Show less
1.12.0
1.12.1
1.13.0
1.13.1
1.13.2
1.13.3
1.14.0
1.15.0
1.15.1
1.16.0
1.16.1
1.17.0
1.18.0
1.18.1
1.18.2
1.18.3
1.18.4
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.6.0
1.6.1
1.6.2
1.7.0
1.8.0
1.9.0
2.0.0
2.1.0
2.10.0
2.10.1
2.11.0
2.12.0
2.13.0
2.13.1
2.13.2
2.14.0
2.14.1
2.14.2
2.14.3
2.14.4
2.14.5
2.14.6
2.14.7
2.15.0
2.16.0
2.16.1
2.17.0
2.17.1
2.18.0
2.19.0
2.19.1
2.19.2
2.2.0
2.2.1
2.2.2
2.20.0
2.21.0
2.3.0
2.3.1
2.3.2
2.4.0
2.5.0
2.5.1
2.5.2
2.6.0
2.6.1
2.6.2
2.7.0
2.7.1
2.8.0
2.9.0
3.0.0
3.0.1
3.0.2
3.1.0
3.2.0
3.3.0
3.3.1
3.3.2
3.4.0
3.4.1
3.5.0
3.5.1
3.6.0
4.0.0
4.1.0
4.1.1
4.2.0
4.3.0
4.4.0
4.4.1
4.4.2
4.5.0
4.6.0
4.6.1
4.7.0
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
5.0.0
Fixed in
5.0.1
References
Updated Oct 02, 2026 · Source: OSV.dev | ||
3.5.1
patch
1 CVE
CVE-2026-66007
GHSA-379c-qx7v-6h59
PYSEC-2026-3716
Jul 24, 2026
Hugging Face Datasets folder-based builders allow path traversal through file_name metadata
Medium
Network
Low
None
Datasets through 5.0.0, fixed in f989ef9, contains a path traversal vulnerability in folder-based dataset builders where the file_name metadata field is not properly validated before being joined to the dataset directory. Attackers can supply crafted file_name values with directory traversal sequences to read arbitrary local files, which are then embedded into output when save_to_disk or push_to_hub is called. Affected versions
0.0.9
1.0.0
1.0.1
1.0.2
1.1.0
1.1.1
1.1.2
1.1.3
1.10.0
1.10.1
1.10.2
1.11.0
+ 106 more Show less
1.12.0
1.12.1
1.13.0
1.13.1
1.13.2
1.13.3
1.14.0
1.15.0
1.15.1
1.16.0
1.16.1
1.17.0
1.18.0
1.18.1
1.18.2
1.18.3
1.18.4
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.6.0
1.6.1
1.6.2
1.7.0
1.8.0
1.9.0
2.0.0
2.1.0
2.10.0
2.10.1
2.11.0
2.12.0
2.13.0
2.13.1
2.13.2
2.14.0
2.14.1
2.14.2
2.14.3
2.14.4
2.14.5
2.14.6
2.14.7
2.15.0
2.16.0
2.16.1
2.17.0
2.17.1
2.18.0
2.19.0
2.19.1
2.19.2
2.2.0
2.2.1
2.2.2
2.20.0
2.21.0
2.3.0
2.3.1
2.3.2
2.4.0
2.5.0
2.5.1
2.5.2
2.6.0
2.6.1
2.6.2
2.7.0
2.7.1
2.8.0
2.9.0
3.0.0
3.0.1
3.0.2
3.1.0
3.2.0
3.3.0
3.3.1
3.3.2
3.4.0
3.4.1
3.5.0
3.5.1
3.6.0
4.0.0
4.1.0
4.1.1
4.2.0
4.3.0
4.4.0
4.4.1
4.4.2
4.5.0
4.6.0
4.6.1
4.7.0
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
5.0.0
Fixed in
5.0.1
References
Updated Oct 02, 2026 · Source: OSV.dev | ||
3.5.0
minor
1 CVE
CVE-2026-66007
GHSA-379c-qx7v-6h59
PYSEC-2026-3716
Jul 24, 2026
Hugging Face Datasets folder-based builders allow path traversal through file_name metadata
Medium
Network
Low
None
Datasets through 5.0.0, fixed in f989ef9, contains a path traversal vulnerability in folder-based dataset builders where the file_name metadata field is not properly validated before being joined to the dataset directory. Attackers can supply crafted file_name values with directory traversal sequences to read arbitrary local files, which are then embedded into output when save_to_disk or push_to_hub is called. Affected versions
0.0.9
1.0.0
1.0.1
1.0.2
1.1.0
1.1.1
1.1.2
1.1.3
1.10.0
1.10.1
1.10.2
1.11.0
+ 106 more Show less
1.12.0
1.12.1
1.13.0
1.13.1
1.13.2
1.13.3
1.14.0
1.15.0
1.15.1
1.16.0
1.16.1
1.17.0
1.18.0
1.18.1
1.18.2
1.18.3
1.18.4
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.6.0
1.6.1
1.6.2
1.7.0
1.8.0
1.9.0
2.0.0
2.1.0
2.10.0
2.10.1
2.11.0
2.12.0
2.13.0
2.13.1
2.13.2
2.14.0
2.14.1
2.14.2
2.14.3
2.14.4
2.14.5
2.14.6
2.14.7
2.15.0
2.16.0
2.16.1
2.17.0
2.17.1
2.18.0
2.19.0
2.19.1
2.19.2
2.2.0
2.2.1
2.2.2
2.20.0
2.21.0
2.3.0
2.3.1
2.3.2
2.4.0
2.5.0
2.5.1
2.5.2
2.6.0
2.6.1
2.6.2
2.7.0
2.7.1
2.8.0
2.9.0
3.0.0
3.0.1
3.0.2
3.1.0
3.2.0
3.3.0
3.3.1
3.3.2
3.4.0
3.4.1
3.5.0
3.5.1
3.6.0
4.0.0
4.1.0
4.1.1
4.2.0
4.3.0
4.4.0
4.4.1
4.4.2
4.5.0
4.6.0
4.6.1
4.7.0
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
5.0.0
Fixed in
5.0.1
References
Updated Oct 02, 2026 · Source: OSV.dev | ||
3.4.1
patch
1 CVE
CVE-2026-66007
GHSA-379c-qx7v-6h59
PYSEC-2026-3716
Jul 24, 2026
Hugging Face Datasets folder-based builders allow path traversal through file_name metadata
Medium
Network
Low
None
Datasets through 5.0.0, fixed in f989ef9, contains a path traversal vulnerability in folder-based dataset builders where the file_name metadata field is not properly validated before being joined to the dataset directory. Attackers can supply crafted file_name values with directory traversal sequences to read arbitrary local files, which are then embedded into output when save_to_disk or push_to_hub is called. Affected versions
0.0.9
1.0.0
1.0.1
1.0.2
1.1.0
1.1.1
1.1.2
1.1.3
1.10.0
1.10.1
1.10.2
1.11.0
+ 106 more Show less
1.12.0
1.12.1
1.13.0
1.13.1
1.13.2
1.13.3
1.14.0
1.15.0
1.15.1
1.16.0
1.16.1
1.17.0
1.18.0
1.18.1
1.18.2
1.18.3
1.18.4
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.6.0
1.6.1
1.6.2
1.7.0
1.8.0
1.9.0
2.0.0
2.1.0
2.10.0
2.10.1
2.11.0
2.12.0
2.13.0
2.13.1
2.13.2
2.14.0
2.14.1
2.14.2
2.14.3
2.14.4
2.14.5
2.14.6
2.14.7
2.15.0
2.16.0
2.16.1
2.17.0
2.17.1
2.18.0
2.19.0
2.19.1
2.19.2
2.2.0
2.2.1
2.2.2
2.20.0
2.21.0
2.3.0
2.3.1
2.3.2
2.4.0
2.5.0
2.5.1
2.5.2
2.6.0
2.6.1
2.6.2
2.7.0
2.7.1
2.8.0
2.9.0
3.0.0
3.0.1
3.0.2
3.1.0
3.2.0
3.3.0
3.3.1
3.3.2
3.4.0
3.4.1
3.5.0
3.5.1
3.6.0
4.0.0
4.1.0
4.1.1
4.2.0
4.3.0
4.4.0
4.4.1
4.4.2
4.5.0
4.6.0
4.6.1
4.7.0
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
5.0.0
Fixed in
5.0.1
References
Updated Oct 02, 2026 · Source: OSV.dev | ||
3.4.0
minor
1 CVE
CVE-2026-66007
GHSA-379c-qx7v-6h59
PYSEC-2026-3716
Jul 24, 2026
Hugging Face Datasets folder-based builders allow path traversal through file_name metadata
Medium
Network
Low
None
Datasets through 5.0.0, fixed in f989ef9, contains a path traversal vulnerability in folder-based dataset builders where the file_name metadata field is not properly validated before being joined to the dataset directory. Attackers can supply crafted file_name values with directory traversal sequences to read arbitrary local files, which are then embedded into output when save_to_disk or push_to_hub is called. Affected versions
0.0.9
1.0.0
1.0.1
1.0.2
1.1.0
1.1.1
1.1.2
1.1.3
1.10.0
1.10.1
1.10.2
1.11.0
+ 106 more Show less
1.12.0
1.12.1
1.13.0
1.13.1
1.13.2
1.13.3
1.14.0
1.15.0
1.15.1
1.16.0
1.16.1
1.17.0
1.18.0
1.18.1
1.18.2
1.18.3
1.18.4
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.6.0
1.6.1
1.6.2
1.7.0
1.8.0
1.9.0
2.0.0
2.1.0
2.10.0
2.10.1
2.11.0
2.12.0
2.13.0
2.13.1
2.13.2
2.14.0
2.14.1
2.14.2
2.14.3
2.14.4
2.14.5
2.14.6
2.14.7
2.15.0
2.16.0
2.16.1
2.17.0
2.17.1
2.18.0
2.19.0
2.19.1
2.19.2
2.2.0
2.2.1
2.2.2
2.20.0
2.21.0
2.3.0
2.3.1
2.3.2
2.4.0
2.5.0
2.5.1
2.5.2
2.6.0
2.6.1
2.6.2
2.7.0
2.7.1
2.8.0
2.9.0
3.0.0
3.0.1
3.0.2
3.1.0
3.2.0
3.3.0
3.3.1
3.3.2
3.4.0
3.4.1
3.5.0
3.5.1
3.6.0
4.0.0
4.1.0
4.1.1
4.2.0
4.3.0
4.4.0
4.4.1
4.4.2
4.5.0
4.6.0
4.6.1
4.7.0
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
5.0.0
Fixed in
5.0.1
References
Updated Oct 02, 2026 · Source: OSV.dev | ||
3.3.2
patch
1 CVE
CVE-2026-66007
GHSA-379c-qx7v-6h59
PYSEC-2026-3716
Jul 24, 2026
Hugging Face Datasets folder-based builders allow path traversal through file_name metadata
Medium
Network
Low
None
Datasets through 5.0.0, fixed in f989ef9, contains a path traversal vulnerability in folder-based dataset builders where the file_name metadata field is not properly validated before being joined to the dataset directory. Attackers can supply crafted file_name values with directory traversal sequences to read arbitrary local files, which are then embedded into output when save_to_disk or push_to_hub is called. Affected versions
0.0.9
1.0.0
1.0.1
1.0.2
1.1.0
1.1.1
1.1.2
1.1.3
1.10.0
1.10.1
1.10.2
1.11.0
+ 106 more Show less
1.12.0
1.12.1
1.13.0
1.13.1
1.13.2
1.13.3
1.14.0
1.15.0
1.15.1
1.16.0
1.16.1
1.17.0
1.18.0
1.18.1
1.18.2
1.18.3
1.18.4
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.6.0
1.6.1
1.6.2
1.7.0
1.8.0
1.9.0
2.0.0
2.1.0
2.10.0
2.10.1
2.11.0
2.12.0
2.13.0
2.13.1
2.13.2
2.14.0
2.14.1
2.14.2
2.14.3
2.14.4
2.14.5
2.14.6
2.14.7
2.15.0
2.16.0
2.16.1
2.17.0
2.17.1
2.18.0
2.19.0
2.19.1
2.19.2
2.2.0
2.2.1
2.2.2
2.20.0
2.21.0
2.3.0
2.3.1
2.3.2
2.4.0
2.5.0
2.5.1
2.5.2
2.6.0
2.6.1
2.6.2
2.7.0
2.7.1
2.8.0
2.9.0
3.0.0
3.0.1
3.0.2
3.1.0
3.2.0
3.3.0
3.3.1
3.3.2
3.4.0
3.4.1
3.5.0
3.5.1
3.6.0
4.0.0
4.1.0
4.1.1
4.2.0
4.3.0
4.4.0
4.4.1
4.4.2
4.5.0
4.6.0
4.6.1
4.7.0
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
5.0.0
Fixed in
5.0.1
References
Updated Oct 02, 2026 · Source: OSV.dev | ||
3.3.1
patch
1 CVE
CVE-2026-66007
GHSA-379c-qx7v-6h59
PYSEC-2026-3716
Jul 24, 2026
Hugging Face Datasets folder-based builders allow path traversal through file_name metadata
Medium
Network
Low
None
Datasets through 5.0.0, fixed in f989ef9, contains a path traversal vulnerability in folder-based dataset builders where the file_name metadata field is not properly validated before being joined to the dataset directory. Attackers can supply crafted file_name values with directory traversal sequences to read arbitrary local files, which are then embedded into output when save_to_disk or push_to_hub is called. Affected versions
0.0.9
1.0.0
1.0.1
1.0.2
1.1.0
1.1.1
1.1.2
1.1.3
1.10.0
1.10.1
1.10.2
1.11.0
+ 106 more Show less
1.12.0
1.12.1
1.13.0
1.13.1
1.13.2
1.13.3
1.14.0
1.15.0
1.15.1
1.16.0
1.16.1
1.17.0
1.18.0
1.18.1
1.18.2
1.18.3
1.18.4
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.6.0
1.6.1
1.6.2
1.7.0
1.8.0
1.9.0
2.0.0
2.1.0
2.10.0
2.10.1
2.11.0
2.12.0
2.13.0
2.13.1
2.13.2
2.14.0
2.14.1
2.14.2
2.14.3
2.14.4
2.14.5
2.14.6
2.14.7
2.15.0
2.16.0
2.16.1
2.17.0
2.17.1
2.18.0
2.19.0
2.19.1
2.19.2
2.2.0
2.2.1
2.2.2
2.20.0
2.21.0
2.3.0
2.3.1
2.3.2
2.4.0
2.5.0
2.5.1
2.5.2
2.6.0
2.6.1
2.6.2
2.7.0
2.7.1
2.8.0
2.9.0
3.0.0
3.0.1
3.0.2
3.1.0
3.2.0
3.3.0
3.3.1
3.3.2
3.4.0
3.4.1
3.5.0
3.5.1
3.6.0
4.0.0
4.1.0
4.1.1
4.2.0
4.3.0
4.4.0
4.4.1
4.4.2
4.5.0
4.6.0
4.6.1
4.7.0
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
5.0.0
Fixed in
5.0.1
References
Updated Oct 02, 2026 · Source: OSV.dev | ||
3.3.0
minor
1 CVE
CVE-2026-66007
GHSA-379c-qx7v-6h59
PYSEC-2026-3716
Jul 24, 2026
Hugging Face Datasets folder-based builders allow path traversal through file_name metadata
Medium
Network
Low
None
Datasets through 5.0.0, fixed in f989ef9, contains a path traversal vulnerability in folder-based dataset builders where the file_name metadata field is not properly validated before being joined to the dataset directory. Attackers can supply crafted file_name values with directory traversal sequences to read arbitrary local files, which are then embedded into output when save_to_disk or push_to_hub is called. Affected versions
0.0.9
1.0.0
1.0.1
1.0.2
1.1.0
1.1.1
1.1.2
1.1.3
1.10.0
1.10.1
1.10.2
1.11.0
+ 106 more Show less
1.12.0
1.12.1
1.13.0
1.13.1
1.13.2
1.13.3
1.14.0
1.15.0
1.15.1
1.16.0
1.16.1
1.17.0
1.18.0
1.18.1
1.18.2
1.18.3
1.18.4
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.6.0
1.6.1
1.6.2
1.7.0
1.8.0
1.9.0
2.0.0
2.1.0
2.10.0
2.10.1
2.11.0
2.12.0
2.13.0
2.13.1
2.13.2
2.14.0
2.14.1
2.14.2
2.14.3
2.14.4
2.14.5
2.14.6
2.14.7
2.15.0
2.16.0
2.16.1
2.17.0
2.17.1
2.18.0
2.19.0
2.19.1
2.19.2
2.2.0
2.2.1
2.2.2
2.20.0
2.21.0
2.3.0
2.3.1
2.3.2
2.4.0
2.5.0
2.5.1
2.5.2
2.6.0
2.6.1
2.6.2
2.7.0
2.7.1
2.8.0
2.9.0
3.0.0
3.0.1
3.0.2
3.1.0
3.2.0
3.3.0
3.3.1
3.3.2
3.4.0
3.4.1
3.5.0
3.5.1
3.6.0
4.0.0
4.1.0
4.1.1
4.2.0
4.3.0
4.4.0
4.4.1
4.4.2
4.5.0
4.6.0
4.6.1
4.7.0
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
5.0.0
Fixed in
5.0.1
References
Updated Oct 02, 2026 · Source: OSV.dev | ||
3.2.0
minor
1 CVE
CVE-2026-66007
GHSA-379c-qx7v-6h59
PYSEC-2026-3716
Jul 24, 2026
Hugging Face Datasets folder-based builders allow path traversal through file_name metadata
Medium
Network
Low
None
Datasets through 5.0.0, fixed in f989ef9, contains a path traversal vulnerability in folder-based dataset builders where the file_name metadata field is not properly validated before being joined to the dataset directory. Attackers can supply crafted file_name values with directory traversal sequences to read arbitrary local files, which are then embedded into output when save_to_disk or push_to_hub is called. Affected versions
0.0.9
1.0.0
1.0.1
1.0.2
1.1.0
1.1.1
1.1.2
1.1.3
1.10.0
1.10.1
1.10.2
1.11.0
+ 106 more Show less
1.12.0
1.12.1
1.13.0
1.13.1
1.13.2
1.13.3
1.14.0
1.15.0
1.15.1
1.16.0
1.16.1
1.17.0
1.18.0
1.18.1
1.18.2
1.18.3
1.18.4
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.6.0
1.6.1
1.6.2
1.7.0
1.8.0
1.9.0
2.0.0
2.1.0
2.10.0
2.10.1
2.11.0
2.12.0
2.13.0
2.13.1
2.13.2
2.14.0
2.14.1
2.14.2
2.14.3
2.14.4
2.14.5
2.14.6
2.14.7
2.15.0
2.16.0
2.16.1
2.17.0
2.17.1
2.18.0
2.19.0
2.19.1
2.19.2
2.2.0
2.2.1
2.2.2
2.20.0
2.21.0
2.3.0
2.3.1
2.3.2
2.4.0
2.5.0
2.5.1
2.5.2
2.6.0
2.6.1
2.6.2
2.7.0
2.7.1
2.8.0
2.9.0
3.0.0
3.0.1
3.0.2
3.1.0
3.2.0
3.3.0
3.3.1
3.3.2
3.4.0
3.4.1
3.5.0
3.5.1
3.6.0
4.0.0
4.1.0
4.1.1
4.2.0
4.3.0
4.4.0
4.4.1
4.4.2
4.5.0
4.6.0
4.6.1
4.7.0
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
5.0.0
Fixed in
5.0.1
References
Updated Oct 02, 2026 · Source: OSV.dev | ||
3.1.0
minor
1 CVE
CVE-2026-66007
GHSA-379c-qx7v-6h59
PYSEC-2026-3716
Jul 24, 2026
Hugging Face Datasets folder-based builders allow path traversal through file_name metadata
Medium
Network
Low
None
Datasets through 5.0.0, fixed in f989ef9, contains a path traversal vulnerability in folder-based dataset builders where the file_name metadata field is not properly validated before being joined to the dataset directory. Attackers can supply crafted file_name values with directory traversal sequences to read arbitrary local files, which are then embedded into output when save_to_disk or push_to_hub is called. Affected versions
0.0.9
1.0.0
1.0.1
1.0.2
1.1.0
1.1.1
1.1.2
1.1.3
1.10.0
1.10.1
1.10.2
1.11.0
+ 106 more Show less
1.12.0
1.12.1
1.13.0
1.13.1
1.13.2
1.13.3
1.14.0
1.15.0
1.15.1
1.16.0
1.16.1
1.17.0
1.18.0
1.18.1
1.18.2
1.18.3
1.18.4
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.6.0
1.6.1
1.6.2
1.7.0
1.8.0
1.9.0
2.0.0
2.1.0
2.10.0
2.10.1
2.11.0
2.12.0
2.13.0
2.13.1
2.13.2
2.14.0
2.14.1
2.14.2
2.14.3
2.14.4
2.14.5
2.14.6
2.14.7
2.15.0
2.16.0
2.16.1
2.17.0
2.17.1
2.18.0
2.19.0
2.19.1
2.19.2
2.2.0
2.2.1
2.2.2
2.20.0
2.21.0
2.3.0
2.3.1
2.3.2
2.4.0
2.5.0
2.5.1
2.5.2
2.6.0
2.6.1
2.6.2
2.7.0
2.7.1
2.8.0
2.9.0
3.0.0
3.0.1
3.0.2
3.1.0
3.2.0
3.3.0
3.3.1
3.3.2
3.4.0
3.4.1
3.5.0
3.5.1
3.6.0
4.0.0
4.1.0
4.1.1
4.2.0
4.3.0
4.4.0
4.4.1
4.4.2
4.5.0
4.6.0
4.6.1
4.7.0
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
5.0.0
Fixed in
5.0.1
References
Updated Oct 02, 2026 · Source: OSV.dev | ||
3.0.2
patch
1 CVE
CVE-2026-66007
GHSA-379c-qx7v-6h59
PYSEC-2026-3716
Jul 24, 2026
Hugging Face Datasets folder-based builders allow path traversal through file_name metadata
Medium
Network
Low
None
Datasets through 5.0.0, fixed in f989ef9, contains a path traversal vulnerability in folder-based dataset builders where the file_name metadata field is not properly validated before being joined to the dataset directory. Attackers can supply crafted file_name values with directory traversal sequences to read arbitrary local files, which are then embedded into output when save_to_disk or push_to_hub is called. Affected versions
0.0.9
1.0.0
1.0.1
1.0.2
1.1.0
1.1.1
1.1.2
1.1.3
1.10.0
1.10.1
1.10.2
1.11.0
+ 106 more Show less
1.12.0
1.12.1
1.13.0
1.13.1
1.13.2
1.13.3
1.14.0
1.15.0
1.15.1
1.16.0
1.16.1
1.17.0
1.18.0
1.18.1
1.18.2
1.18.3
1.18.4
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.6.0
1.6.1
1.6.2
1.7.0
1.8.0
1.9.0
2.0.0
2.1.0
2.10.0
2.10.1
2.11.0
2.12.0
2.13.0
2.13.1
2.13.2
2.14.0
2.14.1
2.14.2
2.14.3
2.14.4
2.14.5
2.14.6
2.14.7
2.15.0
2.16.0
2.16.1
2.17.0
2.17.1
2.18.0
2.19.0
2.19.1
2.19.2
2.2.0
2.2.1
2.2.2
2.20.0
2.21.0
2.3.0
2.3.1
2.3.2
2.4.0
2.5.0
2.5.1
2.5.2
2.6.0
2.6.1
2.6.2
2.7.0
2.7.1
2.8.0
2.9.0
3.0.0
3.0.1
3.0.2
3.1.0
3.2.0
3.3.0
3.3.1
3.3.2
3.4.0
3.4.1
3.5.0
3.5.1
3.6.0
4.0.0
4.1.0
4.1.1
4.2.0
4.3.0
4.4.0
4.4.1
4.4.2
4.5.0
4.6.0
4.6.1
4.7.0
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
5.0.0
Fixed in
5.0.1
References
Updated Oct 02, 2026 · Source: OSV.dev | ||
3.0.1
patch
1 CVE
CVE-2026-66007
GHSA-379c-qx7v-6h59
PYSEC-2026-3716
Jul 24, 2026
Hugging Face Datasets folder-based builders allow path traversal through file_name metadata
Medium
Network
Low
None
Datasets through 5.0.0, fixed in f989ef9, contains a path traversal vulnerability in folder-based dataset builders where the file_name metadata field is not properly validated before being joined to the dataset directory. Attackers can supply crafted file_name values with directory traversal sequences to read arbitrary local files, which are then embedded into output when save_to_disk or push_to_hub is called. Affected versions
0.0.9
1.0.0
1.0.1
1.0.2
1.1.0
1.1.1
1.1.2
1.1.3
1.10.0
1.10.1
1.10.2
1.11.0
+ 106 more Show less
1.12.0
1.12.1
1.13.0
1.13.1
1.13.2
1.13.3
1.14.0
1.15.0
1.15.1
1.16.0
1.16.1
1.17.0
1.18.0
1.18.1
1.18.2
1.18.3
1.18.4
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.6.0
1.6.1
1.6.2
1.7.0
1.8.0
1.9.0
2.0.0
2.1.0
2.10.0
2.10.1
2.11.0
2.12.0
2.13.0
2.13.1
2.13.2
2.14.0
2.14.1
2.14.2
2.14.3
2.14.4
2.14.5
2.14.6
2.14.7
2.15.0
2.16.0
2.16.1
2.17.0
2.17.1
2.18.0
2.19.0
2.19.1
2.19.2
2.2.0
2.2.1
2.2.2
2.20.0
2.21.0
2.3.0
2.3.1
2.3.2
2.4.0
2.5.0
2.5.1
2.5.2
2.6.0
2.6.1
2.6.2
2.7.0
2.7.1
2.8.0
2.9.0
3.0.0
3.0.1
3.0.2
3.1.0
3.2.0
3.3.0
3.3.1
3.3.2
3.4.0
3.4.1
3.5.0
3.5.1
3.6.0
4.0.0
4.1.0
4.1.1
4.2.0
4.3.0
4.4.0
4.4.1
4.4.2
4.5.0
4.6.0
4.6.1
4.7.0
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
5.0.0
Fixed in
5.0.1
References
Updated Oct 02, 2026 · Source: OSV.dev | ||
3.0.0
major
1 CVE
CVE-2026-66007
GHSA-379c-qx7v-6h59
PYSEC-2026-3716
Jul 24, 2026
Hugging Face Datasets folder-based builders allow path traversal through file_name metadata
Medium
Network
Low
None
Datasets through 5.0.0, fixed in f989ef9, contains a path traversal vulnerability in folder-based dataset builders where the file_name metadata field is not properly validated before being joined to the dataset directory. Attackers can supply crafted file_name values with directory traversal sequences to read arbitrary local files, which are then embedded into output when save_to_disk or push_to_hub is called. Affected versions
0.0.9
1.0.0
1.0.1
1.0.2
1.1.0
1.1.1
1.1.2
1.1.3
1.10.0
1.10.1
1.10.2
1.11.0
+ 106 more Show less
1.12.0
1.12.1
1.13.0
1.13.1
1.13.2
1.13.3
1.14.0
1.15.0
1.15.1
1.16.0
1.16.1
1.17.0
1.18.0
1.18.1
1.18.2
1.18.3
1.18.4
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.6.0
1.6.1
1.6.2
1.7.0
1.8.0
1.9.0
2.0.0
2.1.0
2.10.0
2.10.1
2.11.0
2.12.0
2.13.0
2.13.1
2.13.2
2.14.0
2.14.1
2.14.2
2.14.3
2.14.4
2.14.5
2.14.6
2.14.7
2.15.0
2.16.0
2.16.1
2.17.0
2.17.1
2.18.0
2.19.0
2.19.1
2.19.2
2.2.0
2.2.1
2.2.2
2.20.0
2.21.0
2.3.0
2.3.1
2.3.2
2.4.0
2.5.0
2.5.1
2.5.2
2.6.0
2.6.1
2.6.2
2.7.0
2.7.1
2.8.0
2.9.0
3.0.0
3.0.1
3.0.2
3.1.0
3.2.0
3.3.0
3.3.1
3.3.2
3.4.0
3.4.1
3.5.0
3.5.1
3.6.0
4.0.0
4.1.0
4.1.1
4.2.0
4.3.0
4.4.0
4.4.1
4.4.2
4.5.0
4.6.0
4.6.1
4.7.0
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
5.0.0
Fixed in
5.0.1
References
Updated Oct 02, 2026 · Source: OSV.dev | ||
2.21.0
minor
1 CVE
CVE-2026-66007
GHSA-379c-qx7v-6h59
PYSEC-2026-3716
Jul 24, 2026
Hugging Face Datasets folder-based builders allow path traversal through file_name metadata
Medium
Network
Low
None
Datasets through 5.0.0, fixed in f989ef9, contains a path traversal vulnerability in folder-based dataset builders where the file_name metadata field is not properly validated before being joined to the dataset directory. Attackers can supply crafted file_name values with directory traversal sequences to read arbitrary local files, which are then embedded into output when save_to_disk or push_to_hub is called. Affected versions
0.0.9
1.0.0
1.0.1
1.0.2
1.1.0
1.1.1
1.1.2
1.1.3
1.10.0
1.10.1
1.10.2
1.11.0
+ 106 more Show less
1.12.0
1.12.1
1.13.0
1.13.1
1.13.2
1.13.3
1.14.0
1.15.0
1.15.1
1.16.0
1.16.1
1.17.0
1.18.0
1.18.1
1.18.2
1.18.3
1.18.4
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.6.0
1.6.1
1.6.2
1.7.0
1.8.0
1.9.0
2.0.0
2.1.0
2.10.0
2.10.1
2.11.0
2.12.0
2.13.0
2.13.1
2.13.2
2.14.0
2.14.1
2.14.2
2.14.3
2.14.4
2.14.5
2.14.6
2.14.7
2.15.0
2.16.0
2.16.1
2.17.0
2.17.1
2.18.0
2.19.0
2.19.1
2.19.2
2.2.0
2.2.1
2.2.2
2.20.0
2.21.0
2.3.0
2.3.1
2.3.2
2.4.0
2.5.0
2.5.1
2.5.2
2.6.0
2.6.1
2.6.2
2.7.0
2.7.1
2.8.0
2.9.0
3.0.0
3.0.1
3.0.2
3.1.0
3.2.0
3.3.0
3.3.1
3.3.2
3.4.0
3.4.1
3.5.0
3.5.1
3.6.0
4.0.0
4.1.0
4.1.1
4.2.0
4.3.0
4.4.0
4.4.1
4.4.2
4.5.0
4.6.0
4.6.1
4.7.0
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
5.0.0
Fixed in
5.0.1
References
Updated Oct 02, 2026 · Source: OSV.dev | ||
2.20.0
minor
1 CVE
CVE-2026-66007
GHSA-379c-qx7v-6h59
PYSEC-2026-3716
Jul 24, 2026
Hugging Face Datasets folder-based builders allow path traversal through file_name metadata
Medium
Network
Low
None
Datasets through 5.0.0, fixed in f989ef9, contains a path traversal vulnerability in folder-based dataset builders where the file_name metadata field is not properly validated before being joined to the dataset directory. Attackers can supply crafted file_name values with directory traversal sequences to read arbitrary local files, which are then embedded into output when save_to_disk or push_to_hub is called. Affected versions
0.0.9
1.0.0
1.0.1
1.0.2
1.1.0
1.1.1
1.1.2
1.1.3
1.10.0
1.10.1
1.10.2
1.11.0
+ 106 more Show less
1.12.0
1.12.1
1.13.0
1.13.1
1.13.2
1.13.3
1.14.0
1.15.0
1.15.1
1.16.0
1.16.1
1.17.0
1.18.0
1.18.1
1.18.2
1.18.3
1.18.4
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.6.0
1.6.1
1.6.2
1.7.0
1.8.0
1.9.0
2.0.0
2.1.0
2.10.0
2.10.1
2.11.0
2.12.0
2.13.0
2.13.1
2.13.2
2.14.0
2.14.1
2.14.2
2.14.3
2.14.4
2.14.5
2.14.6
2.14.7
2.15.0
2.16.0
2.16.1
2.17.0
2.17.1
2.18.0
2.19.0
2.19.1
2.19.2
2.2.0
2.2.1
2.2.2
2.20.0
2.21.0
2.3.0
2.3.1
2.3.2
2.4.0
2.5.0
2.5.1
2.5.2
2.6.0
2.6.1
2.6.2
2.7.0
2.7.1
2.8.0
2.9.0
3.0.0
3.0.1
3.0.2
3.1.0
3.2.0
3.3.0
3.3.1
3.3.2
3.4.0
3.4.1
3.5.0
3.5.1
3.6.0
4.0.0
4.1.0
4.1.1
4.2.0
4.3.0
4.4.0
4.4.1
4.4.2
4.5.0
4.6.0
4.6.1
4.7.0
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
5.0.0
Fixed in
5.0.1
References
Updated Oct 02, 2026 · Source: OSV.dev | ||
2.19.2
patch
1 CVE
CVE-2026-66007
GHSA-379c-qx7v-6h59
PYSEC-2026-3716
Jul 24, 2026
Hugging Face Datasets folder-based builders allow path traversal through file_name metadata
Medium
Network
Low
None
Datasets through 5.0.0, fixed in f989ef9, contains a path traversal vulnerability in folder-based dataset builders where the file_name metadata field is not properly validated before being joined to the dataset directory. Attackers can supply crafted file_name values with directory traversal sequences to read arbitrary local files, which are then embedded into output when save_to_disk or push_to_hub is called. Affected versions
0.0.9
1.0.0
1.0.1
1.0.2
1.1.0
1.1.1
1.1.2
1.1.3
1.10.0
1.10.1
1.10.2
1.11.0
+ 106 more Show less
1.12.0
1.12.1
1.13.0
1.13.1
1.13.2
1.13.3
1.14.0
1.15.0
1.15.1
1.16.0
1.16.1
1.17.0
1.18.0
1.18.1
1.18.2
1.18.3
1.18.4
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.6.0
1.6.1
1.6.2
1.7.0
1.8.0
1.9.0
2.0.0
2.1.0
2.10.0
2.10.1
2.11.0
2.12.0
2.13.0
2.13.1
2.13.2
2.14.0
2.14.1
2.14.2
2.14.3
2.14.4
2.14.5
2.14.6
2.14.7
2.15.0
2.16.0
2.16.1
2.17.0
2.17.1
2.18.0
2.19.0
2.19.1
2.19.2
2.2.0
2.2.1
2.2.2
2.20.0
2.21.0
2.3.0
2.3.1
2.3.2
2.4.0
2.5.0
2.5.1
2.5.2
2.6.0
2.6.1
2.6.2
2.7.0
2.7.1
2.8.0
2.9.0
3.0.0
3.0.1
3.0.2
3.1.0
3.2.0
3.3.0
3.3.1
3.3.2
3.4.0
3.4.1
3.5.0
3.5.1
3.6.0
4.0.0
4.1.0
4.1.1
4.2.0
4.3.0
4.4.0
4.4.1
4.4.2
4.5.0
4.6.0
4.6.1
4.7.0
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
5.0.0
Fixed in
5.0.1
References
Updated Oct 02, 2026 · Source: OSV.dev | ||
2.19.1
patch
1 CVE
CVE-2026-66007
GHSA-379c-qx7v-6h59
PYSEC-2026-3716
Jul 24, 2026
Hugging Face Datasets folder-based builders allow path traversal through file_name metadata
Medium
Network
Low
None
Datasets through 5.0.0, fixed in f989ef9, contains a path traversal vulnerability in folder-based dataset builders where the file_name metadata field is not properly validated before being joined to the dataset directory. Attackers can supply crafted file_name values with directory traversal sequences to read arbitrary local files, which are then embedded into output when save_to_disk or push_to_hub is called. Affected versions
0.0.9
1.0.0
1.0.1
1.0.2
1.1.0
1.1.1
1.1.2
1.1.3
1.10.0
1.10.1
1.10.2
1.11.0
+ 106 more Show less
1.12.0
1.12.1
1.13.0
1.13.1
1.13.2
1.13.3
1.14.0
1.15.0
1.15.1
1.16.0
1.16.1
1.17.0
1.18.0
1.18.1
1.18.2
1.18.3
1.18.4
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.6.0
1.6.1
1.6.2
1.7.0
1.8.0
1.9.0
2.0.0
2.1.0
2.10.0
2.10.1
2.11.0
2.12.0
2.13.0
2.13.1
2.13.2
2.14.0
2.14.1
2.14.2
2.14.3
2.14.4
2.14.5
2.14.6
2.14.7
2.15.0
2.16.0
2.16.1
2.17.0
2.17.1
2.18.0
2.19.0
2.19.1
2.19.2
2.2.0
2.2.1
2.2.2
2.20.0
2.21.0
2.3.0
2.3.1
2.3.2
2.4.0
2.5.0
2.5.1
2.5.2
2.6.0
2.6.1
2.6.2
2.7.0
2.7.1
2.8.0
2.9.0
3.0.0
3.0.1
3.0.2
3.1.0
3.2.0
3.3.0
3.3.1
3.3.2
3.4.0
3.4.1
3.5.0
3.5.1
3.6.0
4.0.0
4.1.0
4.1.1
4.2.0
4.3.0
4.4.0
4.4.1
4.4.2
4.5.0
4.6.0
4.6.1
4.7.0
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
5.0.0
Fixed in
5.0.1
References
Updated Oct 02, 2026 · Source: OSV.dev | ||
2.19.0
minor
1 CVE
CVE-2026-66007
GHSA-379c-qx7v-6h59
PYSEC-2026-3716
Jul 24, 2026
Hugging Face Datasets folder-based builders allow path traversal through file_name metadata
Medium
Network
Low
None
Datasets through 5.0.0, fixed in f989ef9, contains a path traversal vulnerability in folder-based dataset builders where the file_name metadata field is not properly validated before being joined to the dataset directory. Attackers can supply crafted file_name values with directory traversal sequences to read arbitrary local files, which are then embedded into output when save_to_disk or push_to_hub is called. Affected versions
0.0.9
1.0.0
1.0.1
1.0.2
1.1.0
1.1.1
1.1.2
1.1.3
1.10.0
1.10.1
1.10.2
1.11.0
+ 106 more Show less
1.12.0
1.12.1
1.13.0
1.13.1
1.13.2
1.13.3
1.14.0
1.15.0
1.15.1
1.16.0
1.16.1
1.17.0
1.18.0
1.18.1
1.18.2
1.18.3
1.18.4
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.6.0
1.6.1
1.6.2
1.7.0
1.8.0
1.9.0
2.0.0
2.1.0
2.10.0
2.10.1
2.11.0
2.12.0
2.13.0
2.13.1
2.13.2
2.14.0
2.14.1
2.14.2
2.14.3
2.14.4
2.14.5
2.14.6
2.14.7
2.15.0
2.16.0
2.16.1
2.17.0
2.17.1
2.18.0
2.19.0
2.19.1
2.19.2
2.2.0
2.2.1
2.2.2
2.20.0
2.21.0
2.3.0
2.3.1
2.3.2
2.4.0
2.5.0
2.5.1
2.5.2
2.6.0
2.6.1
2.6.2
2.7.0
2.7.1
2.8.0
2.9.0
3.0.0
3.0.1
3.0.2
3.1.0
3.2.0
3.3.0
3.3.1
3.3.2
3.4.0
3.4.1
3.5.0
3.5.1
3.6.0
4.0.0
4.1.0
4.1.1
4.2.0
4.3.0
4.4.0
4.4.1
4.4.2
4.5.0
4.6.0
4.6.1
4.7.0
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
5.0.0
Fixed in
5.0.1
References
Updated Oct 02, 2026 · Source: OSV.dev | ||
2.18.0
minor
1 CVE
CVE-2026-66007
GHSA-379c-qx7v-6h59
PYSEC-2026-3716
Jul 24, 2026
Hugging Face Datasets folder-based builders allow path traversal through file_name metadata
Medium
Network
Low
None
Datasets through 5.0.0, fixed in f989ef9, contains a path traversal vulnerability in folder-based dataset builders where the file_name metadata field is not properly validated before being joined to the dataset directory. Attackers can supply crafted file_name values with directory traversal sequences to read arbitrary local files, which are then embedded into output when save_to_disk or push_to_hub is called. Affected versions
0.0.9
1.0.0
1.0.1
1.0.2
1.1.0
1.1.1
1.1.2
1.1.3
1.10.0
1.10.1
1.10.2
1.11.0
+ 106 more Show less
1.12.0
1.12.1
1.13.0
1.13.1
1.13.2
1.13.3
1.14.0
1.15.0
1.15.1
1.16.0
1.16.1
1.17.0
1.18.0
1.18.1
1.18.2
1.18.3
1.18.4
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.6.0
1.6.1
1.6.2
1.7.0
1.8.0
1.9.0
2.0.0
2.1.0
2.10.0
2.10.1
2.11.0
2.12.0
2.13.0
2.13.1
2.13.2
2.14.0
2.14.1
2.14.2
2.14.3
2.14.4
2.14.5
2.14.6
2.14.7
2.15.0
2.16.0
2.16.1
2.17.0
2.17.1
2.18.0
2.19.0
2.19.1
2.19.2
2.2.0
2.2.1
2.2.2
2.20.0
2.21.0
2.3.0
2.3.1
2.3.2
2.4.0
2.5.0
2.5.1
2.5.2
2.6.0
2.6.1
2.6.2
2.7.0
2.7.1
2.8.0
2.9.0
3.0.0
3.0.1
3.0.2
3.1.0
3.2.0
3.3.0
3.3.1
3.3.2
3.4.0
3.4.1
3.5.0
3.5.1
3.6.0
4.0.0
4.1.0
4.1.1
4.2.0
4.3.0
4.4.0
4.4.1
4.4.2
4.5.0
4.6.0
4.6.1
4.7.0
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
5.0.0
Fixed in
5.0.1
References
Updated Oct 02, 2026 · Source: OSV.dev | ||
2.17.1
patch
1 CVE
CVE-2026-66007
GHSA-379c-qx7v-6h59
PYSEC-2026-3716
Jul 24, 2026
Hugging Face Datasets folder-based builders allow path traversal through file_name metadata
Medium
Network
Low
None
Datasets through 5.0.0, fixed in f989ef9, contains a path traversal vulnerability in folder-based dataset builders where the file_name metadata field is not properly validated before being joined to the dataset directory. Attackers can supply crafted file_name values with directory traversal sequences to read arbitrary local files, which are then embedded into output when save_to_disk or push_to_hub is called. Affected versions
0.0.9
1.0.0
1.0.1
1.0.2
1.1.0
1.1.1
1.1.2
1.1.3
1.10.0
1.10.1
1.10.2
1.11.0
+ 106 more Show less
1.12.0
1.12.1
1.13.0
1.13.1
1.13.2
1.13.3
1.14.0
1.15.0
1.15.1
1.16.0
1.16.1
1.17.0
1.18.0
1.18.1
1.18.2
1.18.3
1.18.4
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.6.0
1.6.1
1.6.2
1.7.0
1.8.0
1.9.0
2.0.0
2.1.0
2.10.0
2.10.1
2.11.0
2.12.0
2.13.0
2.13.1
2.13.2
2.14.0
2.14.1
2.14.2
2.14.3
2.14.4
2.14.5
2.14.6
2.14.7
2.15.0
2.16.0
2.16.1
2.17.0
2.17.1
2.18.0
2.19.0
2.19.1
2.19.2
2.2.0
2.2.1
2.2.2
2.20.0
2.21.0
2.3.0
2.3.1
2.3.2
2.4.0
2.5.0
2.5.1
2.5.2
2.6.0
2.6.1
2.6.2
2.7.0
2.7.1
2.8.0
2.9.0
3.0.0
3.0.1
3.0.2
3.1.0
3.2.0
3.3.0
3.3.1
3.3.2
3.4.0
3.4.1
3.5.0
3.5.1
3.6.0
4.0.0
4.1.0
4.1.1
4.2.0
4.3.0
4.4.0
4.4.1
4.4.2
4.5.0
4.6.0
4.6.1
4.7.0
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
5.0.0
Fixed in
5.0.1
References
Updated Oct 02, 2026 · Source: OSV.dev | ||
2.17.0
minor
1 CVE
CVE-2026-66007
GHSA-379c-qx7v-6h59
PYSEC-2026-3716
Jul 24, 2026
Hugging Face Datasets folder-based builders allow path traversal through file_name metadata
Medium
Network
Low
None
Datasets through 5.0.0, fixed in f989ef9, contains a path traversal vulnerability in folder-based dataset builders where the file_name metadata field is not properly validated before being joined to the dataset directory. Attackers can supply crafted file_name values with directory traversal sequences to read arbitrary local files, which are then embedded into output when save_to_disk or push_to_hub is called. Affected versions
0.0.9
1.0.0
1.0.1
1.0.2
1.1.0
1.1.1
1.1.2
1.1.3
1.10.0
1.10.1
1.10.2
1.11.0
+ 106 more Show less
1.12.0
1.12.1
1.13.0
1.13.1
1.13.2
1.13.3
1.14.0
1.15.0
1.15.1
1.16.0
1.16.1
1.17.0
1.18.0
1.18.1
1.18.2
1.18.3
1.18.4
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.6.0
1.6.1
1.6.2
1.7.0
1.8.0
1.9.0
2.0.0
2.1.0
2.10.0
2.10.1
2.11.0
2.12.0
2.13.0
2.13.1
2.13.2
2.14.0
2.14.1
2.14.2
2.14.3
2.14.4
2.14.5
2.14.6
2.14.7
2.15.0
2.16.0
2.16.1
2.17.0
2.17.1
2.18.0
2.19.0
2.19.1
2.19.2
2.2.0
2.2.1
2.2.2
2.20.0
2.21.0
2.3.0
2.3.1
2.3.2
2.4.0
2.5.0
2.5.1
2.5.2
2.6.0
2.6.1
2.6.2
2.7.0
2.7.1
2.8.0
2.9.0
3.0.0
3.0.1
3.0.2
3.1.0
3.2.0
3.3.0
3.3.1
3.3.2
3.4.0
3.4.1
3.5.0
3.5.1
3.6.0
4.0.0
4.1.0
4.1.1
4.2.0
4.3.0
4.4.0
4.4.1
4.4.2
4.5.0
4.6.0
4.6.1
4.7.0
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
5.0.0
Fixed in
5.0.1
References
Updated Oct 02, 2026 · Source: OSV.dev | ||
2.16.1
patch
1 CVE
CVE-2026-66007
GHSA-379c-qx7v-6h59
PYSEC-2026-3716
Jul 24, 2026
Hugging Face Datasets folder-based builders allow path traversal through file_name metadata
Medium
Network
Low
None
Datasets through 5.0.0, fixed in f989ef9, contains a path traversal vulnerability in folder-based dataset builders where the file_name metadata field is not properly validated before being joined to the dataset directory. Attackers can supply crafted file_name values with directory traversal sequences to read arbitrary local files, which are then embedded into output when save_to_disk or push_to_hub is called. Affected versions
0.0.9
1.0.0
1.0.1
1.0.2
1.1.0
1.1.1
1.1.2
1.1.3
1.10.0
1.10.1
1.10.2
1.11.0
+ 106 more Show less
1.12.0
1.12.1
1.13.0
1.13.1
1.13.2
1.13.3
1.14.0
1.15.0
1.15.1
1.16.0
1.16.1
1.17.0
1.18.0
1.18.1
1.18.2
1.18.3
1.18.4
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.6.0
1.6.1
1.6.2
1.7.0
1.8.0
1.9.0
2.0.0
2.1.0
2.10.0
2.10.1
2.11.0
2.12.0
2.13.0
2.13.1
2.13.2
2.14.0
2.14.1
2.14.2
2.14.3
2.14.4
2.14.5
2.14.6
2.14.7
2.15.0
2.16.0
2.16.1
2.17.0
2.17.1
2.18.0
2.19.0
2.19.1
2.19.2
2.2.0
2.2.1
2.2.2
2.20.0
2.21.0
2.3.0
2.3.1
2.3.2
2.4.0
2.5.0
2.5.1
2.5.2
2.6.0
2.6.1
2.6.2
2.7.0
2.7.1
2.8.0
2.9.0
3.0.0
3.0.1
3.0.2
3.1.0
3.2.0
3.3.0
3.3.1
3.3.2
3.4.0
3.4.1
3.5.0
3.5.1
3.6.0
4.0.0
4.1.0
4.1.1
4.2.0
4.3.0
4.4.0
4.4.1
4.4.2
4.5.0
4.6.0
4.6.1
4.7.0
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
5.0.0
Fixed in
5.0.1
References
Updated Oct 02, 2026 · Source: OSV.dev | ||
2.16.0
minor
1 CVE
CVE-2026-66007
GHSA-379c-qx7v-6h59
PYSEC-2026-3716
Jul 24, 2026
Hugging Face Datasets folder-based builders allow path traversal through file_name metadata
Medium
Network
Low
None
Datasets through 5.0.0, fixed in f989ef9, contains a path traversal vulnerability in folder-based dataset builders where the file_name metadata field is not properly validated before being joined to the dataset directory. Attackers can supply crafted file_name values with directory traversal sequences to read arbitrary local files, which are then embedded into output when save_to_disk or push_to_hub is called. Affected versions
0.0.9
1.0.0
1.0.1
1.0.2
1.1.0
1.1.1
1.1.2
1.1.3
1.10.0
1.10.1
1.10.2
1.11.0
+ 106 more Show less
1.12.0
1.12.1
1.13.0
1.13.1
1.13.2
1.13.3
1.14.0
1.15.0
1.15.1
1.16.0
1.16.1
1.17.0
1.18.0
1.18.1
1.18.2
1.18.3
1.18.4
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.6.0
1.6.1
1.6.2
1.7.0
1.8.0
1.9.0
2.0.0
2.1.0
2.10.0
2.10.1
2.11.0
2.12.0
2.13.0
2.13.1
2.13.2
2.14.0
2.14.1
2.14.2
2.14.3
2.14.4
2.14.5
2.14.6
2.14.7
2.15.0
2.16.0
2.16.1
2.17.0
2.17.1
2.18.0
2.19.0
2.19.1
2.19.2
2.2.0
2.2.1
2.2.2
2.20.0
2.21.0
2.3.0
2.3.1
2.3.2
2.4.0
2.5.0
2.5.1
2.5.2
2.6.0
2.6.1
2.6.2
2.7.0
2.7.1
2.8.0
2.9.0
3.0.0
3.0.1
3.0.2
3.1.0
3.2.0
3.3.0
3.3.1
3.3.2
3.4.0
3.4.1
3.5.0
3.5.1
3.6.0
4.0.0
4.1.0
4.1.1
4.2.0
4.3.0
4.4.0
4.4.1
4.4.2
4.5.0
4.6.0
4.6.1
4.7.0
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
5.0.0
Fixed in
5.0.1
References
Updated Oct 02, 2026 · Source: OSV.dev | ||
2.15.0
minor
1 CVE
CVE-2026-66007
GHSA-379c-qx7v-6h59
PYSEC-2026-3716
Jul 24, 2026
Hugging Face Datasets folder-based builders allow path traversal through file_name metadata
Medium
Network
Low
None
Datasets through 5.0.0, fixed in f989ef9, contains a path traversal vulnerability in folder-based dataset builders where the file_name metadata field is not properly validated before being joined to the dataset directory. Attackers can supply crafted file_name values with directory traversal sequences to read arbitrary local files, which are then embedded into output when save_to_disk or push_to_hub is called. Affected versions
0.0.9
1.0.0
1.0.1
1.0.2
1.1.0
1.1.1
1.1.2
1.1.3
1.10.0
1.10.1
1.10.2
1.11.0
+ 106 more Show less
1.12.0
1.12.1
1.13.0
1.13.1
1.13.2
1.13.3
1.14.0
1.15.0
1.15.1
1.16.0
1.16.1
1.17.0
1.18.0
1.18.1
1.18.2
1.18.3
1.18.4
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.6.0
1.6.1
1.6.2
1.7.0
1.8.0
1.9.0
2.0.0
2.1.0
2.10.0
2.10.1
2.11.0
2.12.0
2.13.0
2.13.1
2.13.2
2.14.0
2.14.1
2.14.2
2.14.3
2.14.4
2.14.5
2.14.6
2.14.7
2.15.0
2.16.0
2.16.1
2.17.0
2.17.1
2.18.0
2.19.0
2.19.1
2.19.2
2.2.0
2.2.1
2.2.2
2.20.0
2.21.0
2.3.0
2.3.1
2.3.2
2.4.0
2.5.0
2.5.1
2.5.2
2.6.0
2.6.1
2.6.2
2.7.0
2.7.1
2.8.0
2.9.0
3.0.0
3.0.1
3.0.2
3.1.0
3.2.0
3.3.0
3.3.1
3.3.2
3.4.0
3.4.1
3.5.0
3.5.1
3.6.0
4.0.0
4.1.0
4.1.1
4.2.0
4.3.0
4.4.0
4.4.1
4.4.2
4.5.0
4.6.0
4.6.1
4.7.0
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
5.0.0
Fixed in
5.0.1
References
Updated Oct 02, 2026 · Source: OSV.dev | ||
2.14.7
patch
1 CVE
CVE-2026-66007
GHSA-379c-qx7v-6h59
PYSEC-2026-3716
Jul 24, 2026
Hugging Face Datasets folder-based builders allow path traversal through file_name metadata
Medium
Network
Low
None
Datasets through 5.0.0, fixed in f989ef9, contains a path traversal vulnerability in folder-based dataset builders where the file_name metadata field is not properly validated before being joined to the dataset directory. Attackers can supply crafted file_name values with directory traversal sequences to read arbitrary local files, which are then embedded into output when save_to_disk or push_to_hub is called. Affected versions
0.0.9
1.0.0
1.0.1
1.0.2
1.1.0
1.1.1
1.1.2
1.1.3
1.10.0
1.10.1
1.10.2
1.11.0
+ 106 more Show less
1.12.0
1.12.1
1.13.0
1.13.1
1.13.2
1.13.3
1.14.0
1.15.0
1.15.1
1.16.0
1.16.1
1.17.0
1.18.0
1.18.1
1.18.2
1.18.3
1.18.4
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.6.0
1.6.1
1.6.2
1.7.0
1.8.0
1.9.0
2.0.0
2.1.0
2.10.0
2.10.1
2.11.0
2.12.0
2.13.0
2.13.1
2.13.2
2.14.0
2.14.1
2.14.2
2.14.3
2.14.4
2.14.5
2.14.6
2.14.7
2.15.0
2.16.0
2.16.1
2.17.0
2.17.1
2.18.0
2.19.0
2.19.1
2.19.2
2.2.0
2.2.1
2.2.2
2.20.0
2.21.0
2.3.0
2.3.1
2.3.2
2.4.0
2.5.0
2.5.1
2.5.2
2.6.0
2.6.1
2.6.2
2.7.0
2.7.1
2.8.0
2.9.0
3.0.0
3.0.1
3.0.2
3.1.0
3.2.0
3.3.0
3.3.1
3.3.2
3.4.0
3.4.1
3.5.0
3.5.1
3.6.0
4.0.0
4.1.0
4.1.1
4.2.0
4.3.0
4.4.0
4.4.1
4.4.2
4.5.0
4.6.0
4.6.1
4.7.0
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
5.0.0
Fixed in
5.0.1
References
Updated Oct 02, 2026 · Source: OSV.dev | ||
2.14.6
patch
1 CVE
CVE-2026-66007
GHSA-379c-qx7v-6h59
PYSEC-2026-3716
Jul 24, 2026
Hugging Face Datasets folder-based builders allow path traversal through file_name metadata
Medium
Network
Low
None
Datasets through 5.0.0, fixed in f989ef9, contains a path traversal vulnerability in folder-based dataset builders where the file_name metadata field is not properly validated before being joined to the dataset directory. Attackers can supply crafted file_name values with directory traversal sequences to read arbitrary local files, which are then embedded into output when save_to_disk or push_to_hub is called. Affected versions
0.0.9
1.0.0
1.0.1
1.0.2
1.1.0
1.1.1
1.1.2
1.1.3
1.10.0
1.10.1
1.10.2
1.11.0
+ 106 more Show less
1.12.0
1.12.1
1.13.0
1.13.1
1.13.2
1.13.3
1.14.0
1.15.0
1.15.1
1.16.0
1.16.1
1.17.0
1.18.0
1.18.1
1.18.2
1.18.3
1.18.4
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.6.0
1.6.1
1.6.2
1.7.0
1.8.0
1.9.0
2.0.0
2.1.0
2.10.0
2.10.1
2.11.0
2.12.0
2.13.0
2.13.1
2.13.2
2.14.0
2.14.1
2.14.2
2.14.3
2.14.4
2.14.5
2.14.6
2.14.7
2.15.0
2.16.0
2.16.1
2.17.0
2.17.1
2.18.0
2.19.0
2.19.1
2.19.2
2.2.0
2.2.1
2.2.2
2.20.0
2.21.0
2.3.0
2.3.1
2.3.2
2.4.0
2.5.0
2.5.1
2.5.2
2.6.0
2.6.1
2.6.2
2.7.0
2.7.1
2.8.0
2.9.0
3.0.0
3.0.1
3.0.2
3.1.0
3.2.0
3.3.0
3.3.1
3.3.2
3.4.0
3.4.1
3.5.0
3.5.1
3.6.0
4.0.0
4.1.0
4.1.1
4.2.0
4.3.0
4.4.0
4.4.1
4.4.2
4.5.0
4.6.0
4.6.1
4.7.0
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
5.0.0
Fixed in
5.0.1
References
Updated Oct 02, 2026 · Source: OSV.dev | ||
2.14.5
patch
1 CVE
CVE-2026-66007
GHSA-379c-qx7v-6h59
PYSEC-2026-3716
Jul 24, 2026
Hugging Face Datasets folder-based builders allow path traversal through file_name metadata
Medium
Network
Low
None
Datasets through 5.0.0, fixed in f989ef9, contains a path traversal vulnerability in folder-based dataset builders where the file_name metadata field is not properly validated before being joined to the dataset directory. Attackers can supply crafted file_name values with directory traversal sequences to read arbitrary local files, which are then embedded into output when save_to_disk or push_to_hub is called. Affected versions
0.0.9
1.0.0
1.0.1
1.0.2
1.1.0
1.1.1
1.1.2
1.1.3
1.10.0
1.10.1
1.10.2
1.11.0
+ 106 more Show less
1.12.0
1.12.1
1.13.0
1.13.1
1.13.2
1.13.3
1.14.0
1.15.0
1.15.1
1.16.0
1.16.1
1.17.0
1.18.0
1.18.1
1.18.2
1.18.3
1.18.4
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.6.0
1.6.1
1.6.2
1.7.0
1.8.0
1.9.0
2.0.0
2.1.0
2.10.0
2.10.1
2.11.0
2.12.0
2.13.0
2.13.1
2.13.2
2.14.0
2.14.1
2.14.2
2.14.3
2.14.4
2.14.5
2.14.6
2.14.7
2.15.0
2.16.0
2.16.1
2.17.0
2.17.1
2.18.0
2.19.0
2.19.1
2.19.2
2.2.0
2.2.1
2.2.2
2.20.0
2.21.0
2.3.0
2.3.1
2.3.2
2.4.0
2.5.0
2.5.1
2.5.2
2.6.0
2.6.1
2.6.2
2.7.0
2.7.1
2.8.0
2.9.0
3.0.0
3.0.1
3.0.2
3.1.0
3.2.0
3.3.0
3.3.1
3.3.2
3.4.0
3.4.1
3.5.0
3.5.1
3.6.0
4.0.0
4.1.0
4.1.1
4.2.0
4.3.0
4.4.0
4.4.1
4.4.2
4.5.0
4.6.0
4.6.1
4.7.0
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
5.0.0
Fixed in
5.0.1
References
Updated Oct 02, 2026 · Source: OSV.dev | ||
2.13.2
patch
1 CVE
CVE-2026-66007
GHSA-379c-qx7v-6h59
PYSEC-2026-3716
Jul 24, 2026
Hugging Face Datasets folder-based builders allow path traversal through file_name metadata
Medium
Network
Low
None
Datasets through 5.0.0, fixed in f989ef9, contains a path traversal vulnerability in folder-based dataset builders where the file_name metadata field is not properly validated before being joined to the dataset directory. Attackers can supply crafted file_name values with directory traversal sequences to read arbitrary local files, which are then embedded into output when save_to_disk or push_to_hub is called. Affected versions
0.0.9
1.0.0
1.0.1
1.0.2
1.1.0
1.1.1
1.1.2
1.1.3
1.10.0
1.10.1
1.10.2
1.11.0
+ 106 more Show less
1.12.0
1.12.1
1.13.0
1.13.1
1.13.2
1.13.3
1.14.0
1.15.0
1.15.1
1.16.0
1.16.1
1.17.0
1.18.0
1.18.1
1.18.2
1.18.3
1.18.4
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.6.0
1.6.1
1.6.2
1.7.0
1.8.0
1.9.0
2.0.0
2.1.0
2.10.0
2.10.1
2.11.0
2.12.0
2.13.0
2.13.1
2.13.2
2.14.0
2.14.1
2.14.2
2.14.3
2.14.4
2.14.5
2.14.6
2.14.7
2.15.0
2.16.0
2.16.1
2.17.0
2.17.1
2.18.0
2.19.0
2.19.1
2.19.2
2.2.0
2.2.1
2.2.2
2.20.0
2.21.0
2.3.0
2.3.1
2.3.2
2.4.0
2.5.0
2.5.1
2.5.2
2.6.0
2.6.1
2.6.2
2.7.0
2.7.1
2.8.0
2.9.0
3.0.0
3.0.1
3.0.2
3.1.0
3.2.0
3.3.0
3.3.1
3.3.2
3.4.0
3.4.1
3.5.0
3.5.1
3.6.0
4.0.0
4.1.0
4.1.1
4.2.0
4.3.0
4.4.0
4.4.1
4.4.2
4.5.0
4.6.0
4.6.1
4.7.0
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
5.0.0
Fixed in
5.0.1
References
Updated Oct 02, 2026 · Source: OSV.dev | ||
2.14.4
patch
1 CVE
CVE-2026-66007
GHSA-379c-qx7v-6h59
PYSEC-2026-3716
Jul 24, 2026
Hugging Face Datasets folder-based builders allow path traversal through file_name metadata
Medium
Network
Low
None
Datasets through 5.0.0, fixed in f989ef9, contains a path traversal vulnerability in folder-based dataset builders where the file_name metadata field is not properly validated before being joined to the dataset directory. Attackers can supply crafted file_name values with directory traversal sequences to read arbitrary local files, which are then embedded into output when save_to_disk or push_to_hub is called. Affected versions
0.0.9
1.0.0
1.0.1
1.0.2
1.1.0
1.1.1
1.1.2
1.1.3
1.10.0
1.10.1
1.10.2
1.11.0
+ 106 more Show less
1.12.0
1.12.1
1.13.0
1.13.1
1.13.2
1.13.3
1.14.0
1.15.0
1.15.1
1.16.0
1.16.1
1.17.0
1.18.0
1.18.1
1.18.2
1.18.3
1.18.4
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.6.0
1.6.1
1.6.2
1.7.0
1.8.0
1.9.0
2.0.0
2.1.0
2.10.0
2.10.1
2.11.0
2.12.0
2.13.0
2.13.1
2.13.2
2.14.0
2.14.1
2.14.2
2.14.3
2.14.4
2.14.5
2.14.6
2.14.7
2.15.0
2.16.0
2.16.1
2.17.0
2.17.1
2.18.0
2.19.0
2.19.1
2.19.2
2.2.0
2.2.1
2.2.2
2.20.0
2.21.0
2.3.0
2.3.1
2.3.2
2.4.0
2.5.0
2.5.1
2.5.2
2.6.0
2.6.1
2.6.2
2.7.0
2.7.1
2.8.0
2.9.0
3.0.0
3.0.1
3.0.2
3.1.0
3.2.0
3.3.0
3.3.1
3.3.2
3.4.0
3.4.1
3.5.0
3.5.1
3.6.0
4.0.0
4.1.0
4.1.1
4.2.0
4.3.0
4.4.0
4.4.1
4.4.2
4.5.0
4.6.0
4.6.1
4.7.0
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
5.0.0
Fixed in
5.0.1
References
Updated Oct 02, 2026 · Source: OSV.dev |