{"id":"CVE-2025-51481","aliases":["PYSEC-2025-102","GHSA-h7x8-jv97-fvvm","PYSEC-2026-1286"],"title":"Local File Inclusion in dagster._grpc.impl.get_notebook_data in Dagster 1.10.14 allows attackers with access to the gRPC server to read a…","summary":"Local File Inclusion in dagster._grpc.impl.get_notebook_data in Dagster 1.10.14 allows attackers with access to the gRPC server to read arbitrary files by supplying path traversal sequences in the notebook_path field of ExternalNotebookD…","severity":"medium","cvss":6.6,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L","vendor":"dagster-ge","product":"dagster-ge","ecosystem":"pip","affected":["dagster-ge <= 1.10.14"],"patched":["dagster 1.10.16"],"published":"2025-07-22","updated":"2026-09-21","sourceUpdated":"2026-09-21T23:45:02.804296034Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/PYSEC-2025-102","references":[{"url":"https://github.com/dagster-io/dagster/pull/30002"},{"url":"https://github.com/dagster-io/dagster"},{"url":"https://www.gecko.security/blog/cve-2025-51481"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-51481"},{"url":"https://github.com/dagster-io/dagster/commit/3a3cec2b51577c4970e6fc4c199cda6418c09a9d"},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/dagster-ge/PYSEC-2025-102.yaml"}],"tags":["osv","pip"],"epss":0.00545,"epssPercentile":0.4465,"ingestedAt":"2026-07-08T18:25:50.016Z","slug":"CVE-2025-51481","body":"## Overview\n\nLocal File Inclusion in dagster._grpc.impl.get_notebook_data in Dagster 1.10.14 allows attackers with access to the gRPC server to read arbitrary files by supplying path traversal sequences in the notebook_path field of ExternalNotebookData requests, bypassing the intended extension-based check.\n\n## Affected packages\n\n- `dagster-ge <= 1.10.14`\n\n## Remediation\n\nRefer to the advisory for the patched release.","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":36.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}