CVE-2026-91771 wandb CVE debrief

Who should care

Defenders responsible for Weights & Biases wandb installations, as well as security teams monitoring for suspicious activity, should prioritize verifying inventory and upgrading to version 0.29.0 or later. They should also review compensating controls for exposed systems, check relevant monitoring and logs, and track exceptions and retest remediated assets.

Why it matters

CVE-2026-91771 is a high-severity vulnerability in Weights & Biases wandb that allows path traversal attacks, potentially enabling code execution. Defenders should verify inventory, upgrade to version 0.29.0 or later, and monitor for suspicious activity.

• Potential code execution through modification of shell startup files or Python import paths
• Possible unauthorized file writes outside intended download directory
• Required verification of affected versions and scope
• Need for inventory checks and monitoring of suspicious activity

Technical summary

The File.download function in Weights & Biases wandb before 0.29.0 fails to validate file names from server responses, allowing path traversal attacks. Attackers controlling the backend can supply file names with directory traversal sequences to write files outside the intended download directory, potentially enabling code execution through modification of shell startup files or Python import paths. Defenders should prioritize verifying inventory and upgrading to version 0.29.0 or later. The vulnerability has a high CVSS score of 8.7, indicating a high-severity vulnerability.

Defensive priority

Defenders should prioritize verifying inventory and upgrading to version 0.29.0 or later.

Recommended defensive actions

• Verify inventory of Weights & Biases wandb installations
• Upgrade to version 0.29.0 or later
• Monitor for suspicious file downloads and modifications
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. Additional verification is needed to confirm affected versions and scope. Defenders should review the official advisory, verify inventory of affected Weights & Biases wandb installations, and monitor for suspicious file downloads and modifications. The vulnerability has a high CVSS score of 8.7, indicating a high-severity vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.