DagsterGHSA-h7x8-jv97-fvvm

Dagster Local File Inclusion vulnerability

CVE-2025-51481 · Published Jul 22, 2025 · updated Jul 7, 2026

Medium6.6

Fix: upgrade to 1.10.16 or later

Local File Inclusion in dagster._grpc.impl.get_notebook_data in Dagster 1.10.14 allows attackers with access to the gRPC server to read arbitrary files by supplying path traversal sequences in the notebook_path field of ExternalNotebookData requests, bypassing the intended extension-based check.

Affected versions

Package	Affected	Fixed in
dagster PyPI	< 1.10.16	1.10.16

Details and references

CVSS 3.1: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L
Severity from: GitHub (reviewed advisory)
Weakness: CWE-22
Also known as: CVE-2025-51481, PYSEC-2025-102, PYSEC-2026-1286

More Dagster advisories

All Dagster

High 8.3Apr 18

Dagster Vulnerable to SQL Injection via Dynamic Partition Keys in Database I/O Manager IntegrationsCVE-2026-41490fixed in 1.13.1 Medium 7.5Jul 7, 2025

Dagster vulnerable to Path Traversal attack through its /logs endpointCVE-2023-51232fixed in 1.5.11