Hugging Face Datasets path traversal vulnerability

1. 06:43
   GitHub 安全公告

   Hugging Face Datasets folder-based builder has a path traversal vulnerability

   Hugging Face Datasets 5.0.0 and earlier versions have a path traversal vulnerability, fixed in commit f989ef9. The issue is that the folder-based dataset builder does not sufficiently validate the file_name metadata field before concatenating it directly with the dataset directory. An attacker can construct a file_name value with directory traversal sequences to read arbitrary local files, which are written into the output content when save_to_disk or push_to_hub is called.

Current attention 36·Peak in the comparable period 36 (Oct 7 12:00)·Change over the comparable past 24 hours 0%