CVE-2026-111170 in kedro-datasets
Summary
by MITRE • 10/15/2026
kedro-datasets from 9.3.0 through 9.6.0 contains a path traversal vulnerability in MatplotlibDataset.save() that allows attackers to write files outside the dataset directory by supplying absolute plot names. Because validate_sub_path() strips leading slashes while pathlib's join discards the base path, attackers can create or overwrite files anywhere the process can write.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/15/2026
The kedro-datasets library versions 9.3.0 through 9.6.0 contain a critical path traversal vulnerability within the MatplotlibDataset.save() method that enables unauthorized file system access and potential remote code execution depending on the context of the running application. This flaw arises from an improper handling of user-supplied input when constructing file paths for saving matplotlib plots, allowing attackers to escape the designated dataset directory and write or overwrite arbitrary files on the host operating system. The vulnerability is particularly dangerous in environments where kedro pipelines are executed with elevated privileges or against sensitive directories such as configuration folders, web roots, or script locations that could be leveraged for further exploitation.
The technical root cause of this vulnerability lies in a flawed implementation of path validation logic combined with incorrect use of Python's pathlib library functions. Specifically, the validate_sub_path() function attempts to sanitize input by stripping leading slashes from absolute paths provided by users. However, this sanitization step is insufficient because it does not account for how subsequent path joining operations behave when given relative components that traverse upward using dot-dot notation or other escape sequences. When these manipulated paths are passed to pathlib's join method, the library discards the base directory if the joined result resolves to an absolute path or a path outside the intended scope due to normalization quirks. This combination allows attackers to supply plot names containing traversal characters such as ../ which effectively bypass the security boundary established by the dataset configuration.
From a classification perspective, this vulnerability aligns with CWE-22: Improper Limitation of a Pathname to a Restricted Directory, commonly known as path traversal or directory traversal. The attack vector involves supplying maliciously crafted input through the save() method's filename parameter, which is typically derived from user-controlled data in machine learning pipelines or automated reporting systems. According to MITRE ATT&CK framework, this behavior corresponds to T1083: File and Directory Discovery if used for reconnaissance, but more critically it facilitates T1564: Hidden Files and Directories when writing hidden files, or potentially T1059: Command Line Interface if the written file is a script executed by another process. The ability to write arbitrary files can lead to privilege escalation, data integrity compromise, or denial of service conditions depending on what locations are targeted.
The operational impact of this vulnerability extends beyond simple unauthorized writes. An attacker who successfully exploits this flaw could overwrite critical configuration files such as .env variables containing database credentials or API keys, inject malicious code into executable scripts that are part of the kedro pipeline execution flow, or corrupt data artifacts essential for model training and evaluation processes. In cloud-native deployments where containerized services run with specific file system permissions, writing to restricted areas might trigger security alerts but could also be used to persist backdoors if write access is granted to shared volumes. The lack of robust input validation means that any component interacting with MatplotlibDataset.save() without additional external safeguards becomes a potential entry point for attackers aiming to compromise the underlying infrastructure hosting the kedro application.
Mitigation strategies must address both immediate remediation and long-term defensive coding practices. Users should immediately upgrade to a patched version of kedro-datasets where this vulnerability has been resolved through stricter path validation that ensures all resulting paths remain strictly within the configured base directory regardless of input manipulation. For organizations unable to patch instantly, implementing an application-level wrapper around the save() method can provide temporary protection by validating that the final resolved absolute path starts with the expected dataset root using os.path.realpath or pathlib.resolve(). Additionally, enforcing least-privilege principles for the user account running kedro pipelines limits the damage potential even if exploitation occurs. Input sanitization should reject any filename containing traversal sequences like ../ or ..\ before they reach the file system operations, and logging mechanisms should be enhanced to detect anomalous path construction attempts for forensic analysis and alerting purposes.