CVE-2026-91771

HighCVSS 8.8

Published: 15/09/2026(UTC)Updated: 24/09/2026(UTC)Translated: 15/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.17%

66th percentile - higher than 66% of all known CVEs

Summary

Weights & Biases wandb before 0.29.0 fails to validate file names from server responses in the File.download function, allowing path traversal attacks. Attackers controlling the backend can supply file names with directory traversal sequences to write files outside the intended download directory, potentially enabling code execution through modification of shell startup files or Python import paths.

Risk Assessment

Risk of remote code execution or unauthorized file writes, potentially leading to full compromise.

Recommendation

Upgrade wandb to version 0.29.0 or later and limit trust in server responses.

Other vulnerabilities in wandb

CVE-2026-15605Low
A security vulnerability has been detected in wandb version 0.25.2.dev1 in the ArtifactManifestEntry.download function within hashutil.py. It involves the use of a weak hash function during artifact integrity validation. The attack can be initiated remotely but requires a high degree of complexity.

Original NVD description (English source)

Weights & Biases wandb before 0.29.0 fails to validate the file name from server responses in the File.download function, allowing path traversal attacks. Attackers controlling the backend can supply file names with directory traversal sequences to write files outside the intended download directory, potentially enabling code execution through modification of shell startup files or Python import paths.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS