CVE-2026-111170
kedro-datasets 9.3.0 through 9.6.0 Path Traversal via MatplotlibDataset Plot Name
CVSS Score
6.5
EPSS Score
0.0%
EPSS Percentile
0th
kedro-datasets from 9.3.0 through 9.6.0 contains a path traversal vulnerability in MatplotlibDataset.save() that allows attackers to write files outside the dataset directory by supplying absolute plot names. Because validate_sub_path() strips leading slashes while pathlib's join discards the base path, attackers can create or overwrite files anywhere the process can write.
| CWE | CWE-22 |
| Vendor | kedro-org |
| Product | kedro-datasets |
| Published | Oct 15, 2026 |
Stay Ahead of the Next One
Get instant alerts for kedro-org kedro-datasets
Be the first to know when new medium vulnerabilities affecting kedro-org kedro-datasets are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None
Affected Versions
kedro-org / kedro-datasets
9.3.0 ≤ 9.6.0
References
github.com: https://github.com/kedro-org/kedro-plugins/pull/1544 github.com: https://github.com/kedro-org/kedro-plugins/blob/611ce7a20dcb0be655190afb9064468fa278b08c/kedro-datasets/kedro_datasets/matplotlib/matplotlib_dataset.py#L198-L201 github.com: https://github.com/kedro-org/kedro-plugins/blob/611ce7a20dcb0be655190afb9064468fa278b08c/kedro-datasets/kedro_datasets/_utils/security.py#L22 github.com: https://github.com/kedro-org/kedro-plugins/security/advisories/GHSA-cjg8-h5qc-hrjv github.com: https://github.com/kedro-org/kedro-plugins vulncheck.com: https://www.vulncheck.com/advisories/kedro-datasets-9.3.0-through-9.6.0-path-traversal-via-matplotlibdataset-plot-name
Credits
Zachariah Mithani