CVE-2026-66007

Name of the Vulnerable Software and Affected Versions Datasets versions prior to 5.0.1

Description Folder-based dataset builders fail to properly validate the file name metadata field before joining it to the dataset directory. This allows attackers to use directory traversal sequences—a technique used to access files and directories outside the intended folder—to read arbitrary local files. These files are then embedded into the output when the save to disk() or push to hub() functions are called.

Recommendations Update Datasets to version 5.0.1 or later.