All vulnerabilities
CVE-2026-111170CVE-2026-35492GHSA-cjg8-h5qc-hrjvPYSEC-2026-2545

kedro-datasets 9.3.0 through 9.6.0 Path Traversal via MatplotlibDataset Plot Name

kedro-org kedro-datasetsPyPILibraries & packages
Open in ThreatlineRecord JSON
CVSS
7.1High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.39%Chance of exploitation activity in the next 30 days, higher than 31% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in9.3.0Fixed versionOSV
Published15 Oct 2026Updated 21 Oct 2026CVE List

What fixes it

  • 9.3.0kedro-datasets, PyPIOSVpip install "kedro-datasets>=9.3.0"

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

kedro-datasets from 9.3.0 through 9.6.0 contains a path traversal vulnerability in MatplotlibDataset.save() that allows attackers to write files outside the dataset directory by supplying absolute plot names. Because validate_sub_path() strips leading slashes while pathlib's join discards the base path, attackers can create or overwrite files anywhere the process can write.

Text from CVE List

Affected versions 43

  • kedro-datasetsaffected: 9.3.0 through 9.6.0CVE List
  • kedro-datasets, PyPIfrom first release, fixed in 9.3.0OSV
  • kedro-datasets, PyPI0.0.1OSV
  • kedro-datasets, PyPI0.0.2OSV
  • kedro-datasets, PyPI0.0.3OSV
  • kedro-datasets, PyPI0.0.4OSV
  • kedro-datasets, PyPI0.0.5OSV
  • kedro-datasets, PyPI0.0.6OSV
  • kedro-datasets, PyPI0.0.7OSV
  • kedro-datasets, PyPI1.0.0OSV
  • kedro-datasets, PyPI1.0.1OSV
  • kedro-datasets, PyPI1.0.2OSV
  • kedro-datasets, PyPI1.1.0OSV
  • kedro-datasets, PyPI1.1.1OSV
  • kedro-datasets, PyPI1.2.0OSV
  • kedro-datasets, PyPI1.3.0OSV
  • kedro-datasets, PyPI1.4.0OSV
  • kedro-datasets, PyPI1.4.1OSV
  • kedro-datasets, PyPI1.4.2OSV
  • kedro-datasets, PyPI1.5.0OSV
  • kedro-datasets, PyPI1.5.1OSV
  • kedro-datasets, PyPI1.5.2OSV
  • kedro-datasets, PyPI1.5.3OSV
  • kedro-datasets, PyPI1.6.0OSV
  • kedro-datasets, PyPI1.7.0OSV
  • kedro-datasets, PyPI1.7.1OSV
  • kedro-datasets, PyPI1.8.0OSV
  • kedro-datasets, PyPI2.0.0OSV
  • kedro-datasets, PyPI2.1.0OSV
  • kedro-datasets, PyPI3.0.0OSV
  • kedro-datasets, PyPI3.0.1OSV
  • kedro-datasets, PyPI4.0.0OSV
  • kedro-datasets, PyPI4.1.0OSV
  • kedro-datasets, PyPI5.0.0OSV
  • kedro-datasets, PyPI5.1.0OSV
  • kedro-datasets, PyPI6.0.0OSV
  • kedro-datasets, PyPI7.0.0OSV
  • kedro-datasets, PyPI8.0.0OSV
  • kedro-datasets, PyPI8.1.0OSV
  • kedro-datasets, PyPI9.0.0OSV
  • kedro-datasets, PyPI9.1.0OSV
  • kedro-datasets, PyPI9.1.1OSV
  • kedro-datasets, PyPI9.2.0OSV

References 6