unslothai/unsloth · error · ValueError

hf_dataset must not contain '..'

Error message

hf_dataset must not contain '..'

What it means

Raised by the _check_hf_dataset field validator: the dataset id must not contain '..' anywhere in the string. This is a path-traversal guard — the id is used to construct Hub paths, and '..' segments could escape the expected directory. It runs after the 256-char cap and before per-segment regex validation.

Source

Thrown at studio/backend/models/training.py:235

            and self.dataset_slice_end < self.dataset_slice_start
        ):
            raise ValueError(
                "dataset_slice_end must be greater than or equal to dataset_slice_start"
            )
        return self

    @field_validator("hf_dataset")
    @classmethod
    def _check_hf_dataset(cls, v: Optional[str]) -> Optional[str]:
        if v is None:
            return v
        v = v.strip()
        if not v:
            return None
        if len(v) > 256:
            raise ValueError("hf_dataset is too long (max 256 chars)")
        if ".." in v:
            raise ValueError("hf_dataset must not contain '..'")
        if any(_HF_DATASET_ID_SEGMENT_RE.fullmatch(segment) is None for segment in v.split("/")):
            raise ValueError("hf_dataset contains invalid characters or path segments")
        return v

    @field_validator("subset")
    @classmethod
    def _check_subset(cls, v: Optional[str]) -> Optional[str]:
        if v is None:
            return v
        v = v.strip()
        if not v:
            return None
        if len(v) > MAX_HF_DATASET_OPTION_LENGTH:
            raise ValueError(f"subset is too long (max {MAX_HF_DATASET_OPTION_LENGTH} chars)")
        if not valid_hf_dataset_config_name(v):
            raise ValueError("subset contains invalid characters")
        return v

View on GitHub (pinned to 203007d190)

Solutions

1. Send a plain 'owner/dataset' id with no dot-dot sequences.
2. Remove any path normalization (os.path.join/realpath) applied to dataset ids in your client.
3. Sanitize user input by rejecting strings containing '..' before submit.

Example fix

# before
hf_dataset = str(Path(base) / rel)  # may produce '..'
# after
hf_dataset = rel  # plain 'owner/dataset' id

def dataset_id_no_dotdot(body: dict) -> bool:
    return ".." not in (body.get("hf_dataset") or "")

function noDotDot(id: string): boolean {
  return !id.includes('..');
}

When it happens

Trigger: POST a training start request with hf_dataset containing '..', e.g. 'user/../other/dataset' or 'data/../..'.

Common situations: Path-mangling code that tries to normalize or join the dataset id like a filesystem path; user input containing dot-dot from a file browser; test payloads deliberately probing traversal.

Related errors

• local cache path must not contain '..' segments
• dataset path may not contain null bytes
• dataset path may not contain '..' segments: {raw!r}
• save_directory may not contain null bytes
• save_directory may not contain '..' segments

AI-assisted analysis of unslothai/unsloth@203007d190 (2026-08-15). Data as JSON: /api/errors/c7cd7254d4b615ec. Report an issue: GitHub.