Kurz gesagt
- CVE-2025-51481 ist eine Schwachstelle (MITTEL (CVSS 6.6)) in dagster, dagster-ge, dagster (dagsterlabs).
- Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.62%, höher als bei 50.0% aller Schwachstellen.
- Abhilfe: auf 1.10.16 oder neuer aktualisieren.
| Package | Affected versions | Patched versions |
|---|
| dagster PyPI | < 1.10.16
| 1.10.16
|
| dagster-ge PyPI | ≤ 1.10.14
| No fix yet |
| dagster | = 1.10.14
| No fix yet |
Description
Local File Inclusion in dagster._grpc.impl.get_notebook_data in Dagster 1.10.14 allows attackers with access to the gRPC server to read arbitrary files by supplying path traversal sequences in the notebook_path field of ExternalNotebookData requests, bypassing the intended extension-based check.
NVD description
Local File Inclusion in dagster._grpc.impl.get_notebook_data in Dagster 1.10.14 allows attackers with access to the gRPC server to read arbitrary files by supplying path traversal sequences in the notebook_path field of ExternalNotebookData requests, bypassing the intended extension-based check.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free