| Package | Affected versions | Patched versions |
|---|---|---|
| dagster | < 1.10.16 | 1.10.16 |
| dagster-ge | ≤ 1.10.14 | |
| dagster | = 1.10.14 |
Local File Inclusion in dagster._grpc.impl.get_notebook_data in Dagster 1.10.14 allows attackers with access to the gRPC server to read arbitrary files by supplying path traversal sequences in the notebook_path field of ExternalNotebookData requests, bypassing the intended extension-based check.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free