CVE-2026-111170

Medium

Description

kedro-datasets from 9.3.0 through 9.6.0 contains a path traversal vulnerability in MatplotlibDataset.save() that allows attackers to write files outside the dataset directory by supplying absolute plot names. Because validate_sub_path() strips leading slashes while pathlib's join discards the base path, attackers can create or overwrite files anywhere the process can write.

SeverityMedium

CVSS6.5

Exploit probability—

ProductKedro-datasets

PublishedOct 15, 2026

First seenOct 15, 2026

Weakness typeCWE-22Path traversal

How to fix

Update

kedro-datasets9.3.0 or later

Patches

github.com/kedro-org/kedro-plugins/pull/1544

Vendor advisories

github.com/kedro-org/kedro-plugins/security/advisories/GHSA-cjg8-h5qc-hrjv

Affected products

Product	Affected versions	Fixed in
kedro-datasetsPyPI	v < 9.3.0	9.3.0

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.