# CVE-2026-65010: Hugging Face Datasets symlink following in Extractor.extract

Source: https://junglewise.ai/threats/cve-2026-65010-hugging-face-datasets-symlink-following-in-extractor-extract  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-23. Updated: 2026-07-23  
License: CC BY 4.0 with a link back

CVE-2026-65010 · Severity: medium · CVSS 6.6 · Published 2026-07-23

Hugging Face Datasets is a library used by developers and researchers to download and manage large machine learning datasets. A security flaw allows a local attacker to trick the library into writing files to unauthorized locations on the computer's hard drive. In shared computing environments, such as multi-user servers or shared research workstations, this could allow an attacker to overwrite sensitive system files, potentially leading to a full system takeover or data loss.

Technologies: [Hugging Face Datasets](https://junglewise.ai/threats/technologies/datasets). Vendors: [Hugging Face](https://junglewise.ai/threats/vendors/hugging-face).

## Quick answers

**Is CVE-2026-65010 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-65010 being exploited in the wild.

**How severe is CVE-2026-65010?** Medium severity, with a CVSS score of 6.6, published 23 July 2026.

**Which products and versions are affected?** Hugging Face Datasets <= 5.00.

**Is there a fix for CVE-2026-65010?** A patch was published on 2026-07-06: Fix merged into main branch via commit ad2d853 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-65010 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-65010?** Check whether you run Hugging Face Datasets at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A symlink-following vulnerability exists in the `Extractor.extract()` function within `src/datasets/utils/extract.py`. The root cause is a reliance on `shutil.rmtree(output_path, ignore_errors=True)` to clear the extraction directory; in Python 3.8+, this function fails silently when the path is a symbolic link. Because the extraction output paths are predictable (based on a non-salted SHA256 hash of the source URL), a local attacker can pre-plant a symlink at the expected path. When a victim subsequently triggers an extraction, the library follows the symlink and writes the archive contents to the attacker's chosen target directory. This bypasses existing 'Zip-Slip' mitigations (safemembers) which only validate archive member names relative to the resolved output path. The issue is fixed in commit ad2d853 by explicitly unlinking the path if it is a symbolic link before extraction.

## Affected products

- Hugging Face datasets <= 5.00

## Timeline

- 2026-07-03: disclosed: Issue reported to maintainers via GitHub
- 2026-07-06: patched: Fix merged into main branch via commit ad2d853
- 2026-07-23: advisory: CVE-2026-65010 published

## References

- [https://github.com/huggingface/datasets/commit/ad2d853ae2ce41d8068c23b44c2e29004312ccee](https://github.com/huggingface/datasets/commit/ad2d853ae2ce41d8068c23b44c2e29004312ccee)
- [https://github.com/huggingface/datasets/issues/8296](https://github.com/huggingface/datasets/issues/8296)
- [https://github.com/huggingface/datasets/pull/8303](https://github.com/huggingface/datasets/pull/8303)
- [https://www.vulncheck.com/advisories/datasets-symlink-following-arbitrary-file-write-via-extractor-extract](https://www.vulncheck.com/advisories/datasets-symlink-following-arbitrary-file-write-via-extractor-extract)

## Related threats

- [Hugging Face Datasets insecure deserialization in pandas builder](https://junglewise.ai/threats/cve-2026-57845-hugging-face-datasets-through-5-1-0-contains-an-insecure)
- [Hugging Face Datasets path traversal in folder-based builders](https://junglewise.ai/threats/cve-2026-66007-hugging-face-datasets-path-traversal-in-folder-based-builders)