The recent intrusion into Hugging Face used an HDF5 capability to disclose files from a production dataset worker. If your application or service processes HDF5 files from users, public repositories, automated pipelines, or AI agents, this incident deserves attention.
The attacker uploaded valid HDF5 files whose datasets used external raw storage to reference local paths, including /proc/self/environ. The HDF5 library read those files using the hosting service’s permissions, which then returned their contents.
An important distinction: this was not an HDF5 vulnerability.
External raw storage is intentional, documented behavior that has existed since HDF5 1.0.0. The HDF5 library has no privileges of its own. It runs with the authority of its hosting process. In this case, untrusted input induced a trusted service to misuse that authority. This was a confused deputy problem at the service’s trust boundary.
That distinction does not mean that no action is needed. Services processing untrusted HDF5 files should consider:
-
rejecting external raw storage unless explicitly required;
-
identifying external references without following them;
-
limiting readers’ filesystem access;
-
restricting permitted paths to approved locations; and
-
applying similar controls to external links, virtual dataset sources, and dynamically loaded plugins.
Read the background
Join the technical discussion
A discussion about how HDF5 can help applications identify, restrict, and audit file-controlled resource access is underway in HDF5 GitHub issue #6618.
We particularly want to hear from people who maintain applications, services, converters, viewers, repositories, or pipelines that open files from outside their trust boundary:
-
Does your software accept untrusted HDF5 files?
-
Do your workflows legitimately require external storage, external links, virtual datasets, or plugins?
-
What protections would help without breaking valid uses?
-
Which behaviors should an untrusted-file profile permit, reject, or require explicit authorization for?
Please comment here or join the GitHub discussion.
Help set the broader priorities
This incident is one example of the safety, security, and privacy questions facing the HDF5 ecosystem. Please also complete our short HDF5 Safety, Security, and Privacy survey.
Your experience will help us focus HDF5 SHINES work on the risks, use cases, and safeguards that matter most to the community.
This material is based upon work supported by the U.S. National Science Foundation under Federal Award No. 2534078. Any opinions, findings, conclusions, or recommendations expressed are those of the author and do not necessarily reflect the views of the National Science Foundation.