Kedro Datasets CVE-2026-111170

Exploitation requires the attacker to control the plot-name keys in the dictionary passed to MatplotlibDataset.save() (or analogously partition IDs in PartitionedDataset) and to supply an absolute path - POSIX ('/outside.png'), Windows drive ('C:\\outside.png', 'C:outside.png'), or UNC ('\\\\server\\share\\outside.png'). No special non-default configuration is needed: affected versions 9.3.0-9.6.0 are vulnerable out of the box because validate_sub_path() strips leading slashes and pathlib's join discards the base path. The practical limiting factor is that the attacker must be able to inject those plot names into the pipeline (via untrusted input data or catalog configuration), so this is not reachable by a wholly external, unauthenticated actor against a default Kedro install unless pipeline inputs are untrusted; write impact is also bounded to locations the Kedro process user can write.

This is a genuine but context-dependent integrity issue rather than a top-tier emergency. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) scores 7.1 (High) and isolates the impact cleanly to integrity (VI:H, VC:N, VA:N) - consistent with an arbitrary file-write primitive that does not directly leak data or crash the service. No EPSS score and no SSVC decision data were provided, and the input shows KEV=NO and no POC flag, so by the precision rules this is 'no public exploit identified at time of analysis.' The PR:L requirement is the key risk-limiter: exploitation requires the attacker to control the plot-name keys passed into MatplotlibDataset.save(), which in a Kedro deployment means influence over pipeline inputs or catalog configuration rather than unauthenticated internet reach. A notable conflict exists in the source data: the linked GHSA-cjg8-h5qc-hrjv advisory describes a DIFFERENT sink (PartitionedDataset, fixed in 9.3.0), whereas this CVE concerns MatplotlibDataset in 9.3.0-9.6.0 fixed by PR #1544 - so the advisory corroborates a class of path-traversal bugs in this package but does not directly confirm this specific CVE's fixed version; verify the fixed release against PR #1544 and the project RELEASE.md. Overall: a real priority for anyone running untrusted inputs through these datasets, but not a mass-exploitation 'patch-tonight' event given the privilege prerequisite and absence of exploitation signals.

An attacker who can influence the data or configuration feeding a Kedro pipeline supplies an absolute plot name such as '/etc/cron.d/evil' or 'C:\\outside.png' to a MatplotlibDataset. When save() runs, validate_sub_path() strips the leading slash while pathlib's join discards the base directory, so the figure is written to the attacker-chosen absolute location, overwriting arbitrary files the process can write. No public exploit code is identified, but the fix's regression tests demonstrate the exact malicious inputs.