En bref
- CVE-2025-51481 est une vulnérabilité MOYENNE (CVSS 6.6) touchant dagster, dagster-ge, dagster (dagsterlabs).
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.62%, plus élevée que 50.0% des vulnérabilités.
- Correctif : mettre à jour vers 1.10.16 ou plus récent.
| Package | Affected versions | Patched versions |
|---|
| dagster PyPI | < 1.10.16
| 1.10.16
|
| dagster-ge PyPI | ≤ 1.10.14
| No fix yet |
| dagster | = 1.10.14
| No fix yet |
Description
Local File Inclusion in dagster._grpc.impl.get_notebook_data in Dagster 1.10.14 allows attackers with access to the gRPC server to read arbitrary files by supplying path traversal sequences in the notebook_path field of ExternalNotebookData requests, bypassing the intended extension-based check.
NVD description
Local File Inclusion in dagster._grpc.impl.get_notebook_data in Dagster 1.10.14 allows attackers with access to the gRPC server to read arbitrary files by supplying path traversal sequences in the notebook_path field of ExternalNotebookData requests, bypassing the intended extension-based check.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free