PT-2026-113968

Ludwig is a low-code framework for building custom LLMs, neural networks, and other AI models. Prior to 0.17.8, ludwig.datasets.archives.extract archive validated tar member names before calling TarFile.extractall but did not validate symlink members or hard-link members. A crafted archive could...