CVE-2025-51481: Dagster Local File Inclusion vulnerability
(updated )
Local File Inclusion in dagster._grpc.impl.get_notebook_data in Dagster 1.10.14 allows attackers with access to the gRPC server to read arbitrary files by supplying path traversal sequences in the notebook_path field of ExternalNotebookData requests, bypassing the intended extension-based check.
References
- github.com/advisories/GHSA-h7x8-jv97-fvvm
- github.com/dagster-io/dagster
- github.com/dagster-io/dagster/commit/3a3cec2b51577c4970e6fc4c199cda6418c09a9d
- github.com/dagster-io/dagster/pull/30002
- github.com/pypa/advisory-database/tree/main/vulns/dagster-ge/PYSEC-2025-102.yaml
- nvd.nist.gov/vuln/detail/CVE-2025-51481
- www.gecko.security/blog/cve-2025-51481
Code Behaviors & Features
Detect and mitigate CVE-2025-51481 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →