CVE-2026-65010

MediumCVSS 6.6

Published: 23/07/2026(UTC)Updated: 24/10/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.17%

6th percentile - higher than 6% of all known CVEs

Summary

Datasets up to version 5.00 (fixed in commit ad2d853) has a symlink-following vulnerability in Extractor.extract(). A local attacker can pre-plant symlinks at predictable output paths to write arbitrary files outside the target directory.

Risk Assessment

An attacker can overwrite sensitive files, potentially leading to privilege escalation or code execution in shared-cache environments.

Recommendation

Update Datasets to a version containing commit ad2d853 or later.

Other vulnerabilities in Datasets

CVE-2026-66007Medium
Path traversal vulnerability in the Datasets library up to version 5.0.0. The file_name metadata field is not properly validated before being joined to the dataset directory, allowing attackers to read arbitrary local files using '../' sequences.

Original NVD description (English source)

Datasets through 5.00, fixed in commit ad2d853, contains a symlink-following vulnerability in Extractor.extract() that allows local attackers to write arbitrary files by pre-planting symlinks at predictable output paths. Attackers can redirect archive extraction to arbitrary filesystem locations in shared-cache environments, enabling overwrite of sensitive files and potential privilege escalation or code execution.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS