CORNAC · CVE-2026-43637 · Package
FIX → 2.6.0
Cornac's dataset downloader extracts TAR archives without checking paths, so a malicious archive can write files anywhere the running process can write. An attacker who controls a downloaded archive can overwrite arbitrary files on the machine running Cornac.
first public Jul 15, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Any application that imports cornac and uses its built-in dataset loaders, which download and extract TAR archives into the cache directory. The exposure depends on whether the archive source is trusted; scripts that only use locally bundled data or already-patched versions can skip it.
Not affected if cornac-2.6.0-or-later, no-dataset-loaders
Who cares cornac, data-science, python
pip show cornac and check whether the version is below 2.6.0._extract_archive or the built-in dataset loaders, which download and extract archives.Upgrade to 2.6.0
cornac (PyPI) to 2.6.0.Cornac before 2.6.0 contains a path traversal (Tar Slip) vulnerability that allows attackers to write arbitrary files outside the intended cache directory by supplying a crafted TAR archive containing ../ sequences, absolute paths, or symlink/hardlink entries to the _extract_archive() function in cornac/utils/download.py. Attackers can trigger this vulnerability through the built-in dataset loaders, which automatically download and extract archives, causing archive.extractall() to write files to arbitrary locations on the filesystem accessible to the running process.
This page as .md ·
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
GitHub Advisory Database, CC-BY 4.0. Posts quoted belong to their authors.