The vulnerability resides in the Extractor.extract function in Huggingface Datasets up to version 5.00. By pre‑creating predictable symbolic links in the shared cache directory, a local attacker can influence the extraction process to overwrite any file on the filesystem. This allows modification or replacement of sensitive files, with the potential for privilege escalation or code execution. The weakness is a classic file‑write via symlink manipulation (CWE-61).

Affected systems are installations of Huggingface Datasets versions up to 5.00, including any environments that employ shared‑cache handling for dataset downloads. The CVE entry references the commit that fixed the issue (ad2d853) but no vendors other than Huggingface are listed. Upgrading to a release that incorporates this commit resolves the flaw.

The CVSS score of 4.4 indicates moderate severity. EPSS is below 1%, suggesting a very low probability of exploitation in the wild. The vulnerability is not listed in CISA KEV and requires local access to the machine that hosts the shared cache. Attackers would need to have a foothold on the system to pre‑plant symlinks, so the attack surface is limited to compromised accounts or malicious code with cache write privileges.