CVE-2026-91771 debrief: Weights & Biases wandb before 0.29.0 fails to validate file names from server responses, allowing path traversal attacks. This CVE was published on 2026-09-15T02:16:49.680Z and was last modified on 2026-09-18T18:18:04.030Z. The vulnerability allows attackers controlling the backend to supply file names with directory traversal sequences, potentially enabling code execution through [truncated]
A security vulnerability has been detected in wandb 0.25.2.dev1, specifically in the ArtifactManifestEntry.download function within the wandb/sdk/lib/hashutil.py file, which is part of the Artifact Integrity Validation component. The issue involves the use of a weak hash. The attack may be initiated remotely, but a high degree of complexity is needed, and exploitability is considered difficult. A pull req [truncated]
