Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

huggingface/datasets

              main @ b713dcd
            

Fixes

CVEs

CRITICAL

Peak severity

40.0%

Coverage

Highlights

Arbitrary Code Execution: 1 prior fix. Scrutinize any change in this area.

CI/CD: most-fixed (1 issue). Treat as high-risk during review.

3 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Remote Code Execution: Loading datasets historically allowed the execution of arbitrary remote Python scripts embedded in repository configs. Developers must strictly enforce the removal of remote script execution and control trust boundaries.

Arbitrary Code Execution: Deserialization of untrusted PyExtensionType structures in PyArrow features can lead to arbitrary code execution (CVE-2023-47248). Developers must ensure the hotfix package is imported and unsafe extension types are blocked.

Path Traversal: Unsafe extraction of zip archives using extractall allowed directory traversal and arbitrary file write attacks. Extracted path sanitization and flattening via hashing must be enforced.