Description
kedro-datasets from 9.3.0 through 9.6.0 contains a path traversal vulnerability in MatplotlibDataset.save() that allows attackers to write files outside the dataset directory by supplying absolute plot names. Because validate_sub_path() strips leading slashes while pathlib's join discards the base path, attackers can create or overwrite files anywhere the process can write.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
kedro-org kedro-datasets
Default version status: unaffected
9.3.0 to ≤ 9.6.0affected
pkg:pypi/kedro-datasetsReferences
- https://github.com/kedro-org/kedro-plugins/pull/1544 ↗
- https://github.com/kedro-org/kedro-plugins/blob/611ce7a20dcb0be655190afb9064468fa278b08c/kedro-datasets/kedro_datasets/matplotlib/matplotlib_dataset.py#L198-L201 ↗
- https://github.com/kedro-org/kedro-plugins/blob/611ce7a20dcb0be655190afb9064468fa278b08c/kedro-datasets/kedro_datasets/_utils/security.py#L22 ↗
- https://github.com/kedro-org/kedro-plugins/security/advisories/GHSA-cjg8-h5qc-hrjv ↗
- https://github.com/kedro-org/kedro-plugins ↗
- https://www.vulncheck.com/advisories/kedro-datasets-9.3.0-through-9.6.0-path-traversal-via-matplotlibdataset-plot-name ↗