CVE-2026-111170

Name of the Vulnerable Software and Affected Versions kedro-datasets versions 9.3.0 through 9.6.0

Description A path traversal issue exists in the MatplotlibDataset.save() function. This occurs because the validate sub path() function strips leading slashes, but the subsequent pathlib join operation discards the base path when an absolute plot name is provided. This allows an attacker to create or overwrite files outside the intended dataset directory anywhere the process has write permissions.

Recommendations Update kedro-datasets to a version later than 9.6.0. As a temporary mitigation, avoid providing absolute paths as plot names when using the MatplotlibDataset.save() function.