Executive brief
Weights & Biases' wandb library is an AI development platform used by data scientists and ML engineers to track experiments, manage models, and store training artifacts. Before version 0.29.0, the File.download function fails to validate file names received from the backend, allowing an attacker controlling the wandb backend to write files to arbitrary locations on the user's system. This could enable code execution by modifying shell startup files or Python import paths.
Technical details
The vulnerability is a path traversal (directory traversal) flaw in wandb's File.download function. The root cause is insufficient validation of file names returned in server responses; the function accepts file names containing directory traversal sequences (e.g., "../") without sanitization. An attacker who controls the wandb backend can supply malicious file names that write files outside the intended download directory. The attack requires a compromised or malicious backend server; no user interaction or additional authentication bypass is necessary beyond connecting to the server. Successful exploitation can lead to arbitrary file write and potentially remote code execution. The fix is available in version 0.29.0 and later.
Affected products
- Weights & Biases wandb before 0.29.0
Timeline
- 2026-09-15: disclosed