Symlink Following in Datasets Archive Extractor

Executive Summary

This vulnerability is a symlink-following issue in the Hugging Face datasets library (versions 5.00 and earlier). It occurs in the Extractor.extract() function during archive extraction. An attacker with write access to a shared cache directory can pre-plant a symlink at a predictable output path. When extraction runs, the symlink is followed, causing files to be written to an arbitrary target directory instead of the intended location. This enables overwriting sensitive files, privilege escalation, or code execution.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect the Hugging Face datasets library version. Run: pip show datasets. If version is 5.00 or earlier, the system is vulnerable. Check for unexpected symlinks in the cache directory, typically ~/.cache/huggingface/datasets. Use: ls -la ~/.cache/huggingface/datasets. Look for symlinks pointing to sensitive paths.

Monitor file writes during extraction. Use strace to trace system calls: strace -f -e trace=file python your_script.py 2>&1 | grep -i symlink. Check for arbitrary file writes in shared directories.

Useful 0 Not Useful 0

Impact Analysis

If you use the Hugging Face datasets library in a shared environment (e.g., CI runners, multi-user servers, Docker volumes), an attacker could overwrite sensitive files, escalate privileges, or execute arbitrary code with your privileges. This happens because the library fails to properly handle symlinks during extraction, allowing redirection to unintended filesystem locations.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized file access or modification, violating data integrity and confidentiality requirements in GDPR and HIPAA. For example, overwriting sensitive files (e.g., configuration, logs, or databases) may result in non-compliance with access control and audit requirements. The risk is higher in shared environments where multiple users or processes interact with the same cache directory.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade the Hugging Face datasets library to a version beyond 5.00, specifically commit ad2d853 or later. Run: pip install --upgrade datasets. This patch removes the symlink-following vulnerability by checking and removing symlinks before extraction.

Restrict write access to the Hugging Face cache directory. Ensure only authorized users can write to ~/.cache/huggingface/datasets. Set permissions to 750 or stricter. Remove any existing symlinks in the cache directory to prevent exploitation.

Useful 0 Not Useful 0