In short
- CVE-2025-51481 is a MEDIUM (CVSS 6.6) vulnerability affecting dagster, dagster-ge, dagster (dagsterlabs).
- Chance of exploitation in the next 30 days (EPSS): 0.62%, higher than 50.0% of all vulnerabilities.
- Fix: update to 1.10.16 or later.
| Package | Affected versions | Patched versions |
|---|
| dagster PyPI | < 1.10.16
| 1.10.16
|
| dagster-ge PyPI | ≤ 1.10.14
| No fix yet |
| dagster | = 1.10.14
| No fix yet |
Description
Local File Inclusion in dagster._grpc.impl.get_notebook_data in Dagster 1.10.14 allows attackers with access to the gRPC server to read arbitrary files by supplying path traversal sequences in the notebook_path field of ExternalNotebookData requests, bypassing the intended extension-based check.
NVD description
Local File Inclusion in dagster._grpc.impl.get_notebook_data in Dagster 1.10.14 allows attackers with access to the gRPC server to read arbitrary files by supplying path traversal sequences in the notebook_path field of ExternalNotebookData requests, bypassing the intended extension-based check.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free