What happened
Verified via NVD REST API (published 2026-10-14, CVSS 8.1, CWE-22/59, GHSA-qvrm-3x4c-rcxf). The fix (0.17.8) rejects escaping link members in the dataset-archive extraction path.
Why it matters
ML training pipelines routinely pull dataset archives from remote/hosted sources; a compromised archive can plant files (e.g. into config, cache, or the model directory) while the framework runs with the orchestrator's privileges — a practical poisoning/overwrite path into the ML build. Trainers should extract from pinned, vetted sources and run extraction in a sandboxed/least-privilege context.
Attack vector
extract_archive() validates tar member names before TarFile.extractall() but not symlink/hard-link members; a crafted archive creates a link escaping the extraction directory, then writes later members through it to an arbitrary filesystem path (CWE-22/59). The commonprefix containment check also allows a sibling path sharing the destination's character prefix. Python 3.14 is immune (default tar data filter).
Affected systems
ludwig-ai/ludwig < 0.17.8 (Python 3.12/3.13)
Mitigation
Upgrade to ludwig >= 0.17.8; validate archive provenance before extraction; prefer running dataset ingestion in containers with restricted filesystem access.