CVE-2026-111170 Details

A path traversal vulnerability has been identified in the Kedro-Datasets package, specifically in versions 9.3.0 prior to 9.6.0. The issue arises within the MatplotlibDataset.save() method, where absolute plot names can be supplied, allowing attackers to write files outside the designated dataset directory. This vulnerability exploits the fact that the validate_sub_path() function removes leading slashes, while pathlib's join method ignores the base path, enabling the creation or overwriting of files in any location where the process has write permissions.

Users should upgrade to Kedro-Datasets version 9.3.0 or later. The vulnerability has been patched by normalizing paths to remove any traversal components and validating that the resolved path remains within the dataset's base directory before use.