CVE-2026-91771

Name of the Vulnerable Software and Affected Versions Weights & Biases wandb versions prior to 0.29.0

Description Insufficient validation of file names received from server responses in the File.download() function allows path traversal attacks. An attacker controlling the backend can use directory traversal sequences to write files outside the designated download directory. This could lead to code execution by modifying Python import paths or shell startup files.

Recommendations Update to version 0.29.0 or later.