Path Traversal Vulnerability in kedro-datasets by Kedro

CVE-2026-111170

What is CVE-2026-111170?

The kedro-datasets product from versions 9.3.0 to 9.6.0 features a path traversal vulnerability within the MatplotlibDataset.save() function. This flaw enables attackers to manipulate plot names to write files outside the designated dataset directory. Specifically, the validate_sub_path() function incorrectly strips leading slashes, allowing users to take advantage of this to create or overwrite files in locations where the application has write permissions, leading to potential compromise of the system.

References