CVE-2025-51481: Dagster path traversal in gRPC ExternalNotebookData endpoint

CVE-2025-51481 · Severity: medium · CVSS 6.6 · Published 2025-07-22

Dagster is an orchestration platform used to manage data workflows and pipelines. A security vulnerability in its internal communication server allows an attacker with access to that server to read sensitive files from the underlying system. This could lead to the exposure of credentials, API keys, or proprietary data, though the risk is primarily limited to environments where the server is exposed beyond its default local settings.

Technologies: dagster (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2025-51481 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-51481 being exploited in the wild.
How severe is CVE-2025-51481?
Medium severity, with a CVSS score of 6.6, published 22 July 2025.
Which products and versions are affected?
dagster (PyPI) < 1.10.16, ECOSYSTEM:introduced=0,fixed=1.10.16; dagster-ge (PyPI) ECOSYSTEM:introduced=0,last_affected=1.10.14.
Is there a fix for CVE-2025-51481?
Yes. dagster (PyPI): upgrade to 1.10.16 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-51481 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2025-51481?
Check whether you run dagster (PyPI) or dagster-ge (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • dagster (PyPI): upgrade to 1.10.16 or later
    pip install "dagster>=1.10.16"

Technical details

A Local File Inclusion (LFI) vulnerability exists in the `dagster._grpc.impl.get_notebook_data` function within Dagster. The root cause is insufficient validation of the `notebook_path` field in `ExternalNotebookData` gRPC requests; the application only checks if the path ends with a `.ipynb` extension and fails to neutralize directory traversal sequences (e.g., `../`). An attacker with network access to the gRPC server can exploit this by appending `.ipynb` to a traversal string to bypass the extension check and read any file the Dagster process has permissions to access. While the gRPC server binds to localhost by default, the vulnerability is exploitable in custom or cloud deployments where the interface is exposed. The issue is fixed in version 1.10.16.

Affected products

  • Dagster Labs Dagster < 1.10.16

Identifiers

  • CVE-2025-51481
  • GHSA-h7x8-jv97-fvvm
  • PYSEC-2025-102
  • PYSEC-2026-1286

Timeline

  • 2025-05-14: disclosed: Vulnerability details shared by Gecko Security
  • 2025-05-19: patched: Fix merged into master branch via PR 30002
  • 2025-07-22: advisory: GitHub Advisory and CVE published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.