A path traversal vulnerability in the Weights & Biases wandb library allows remote attackers to write arbitrary files to the local system, potentially leading to remote code execution.

The vulnerability resides in the File.download function, where the software fails to validate file names provided by the server. An attacker controlling the backend or an intercepted response can inject directory traversal sequences to write files outside the intended directory, affecting any user or process utilizing the library.

Successful exploitation allows an attacker to overwrite critical system files or inject malicious scripts into shell startup files and Python environments. Given the CVSS score of 8.8, this vulnerability poses a high risk of remote code execution, which could result in a full compromise of the local machine, data exfiltration, or lateral movement within a development or production environment.

Immediate Action: Update the wandb library to version 0.29.0 or later immediately to incorporate the necessary file name validation logic.

Proactive Monitoring: Review application logs for unexpected file write operations or access patterns originating from the wandb library. Monitor for unauthorized modifications to sensitive system files or shell configuration scripts.

Compensating Controls: Ensure that applications using wandb run with the least privilege necessary, specifically restricting the file system access of the service account to only the required directories to prevent unintended file writes.

Public Exploit Available: Unknown

This vulnerability represents a significant security risk for any environment utilizing the wandb library for file handling. Because the flaw can lead to remote code execution, organizations should prioritize updating to version 0.29.0 across all affected development and production pipelines as soon as possible to mitigate the risk of system compromise.