Kedro-plugins path traversal vulnerability

The kedro-plugins versions from 9.3.0 to 9.6.0 have a path traversal vulnerability. This vulnerability stems from a path traversal issue in the MatplotlibDataset.save function. The validatesubpath function removes leading slashes, and the join method of pathlib discards the base path. Attackers c...

Kedro-Plugins path traversal vulnerability

Kedro-Plugins is an official plugin collection for the Kedro framework, developed by Kedro itself. Versions of Kedro-Plugins prior to 9.3.0 contained a path traversal vulnerability. This vulnerability stemmed from PartitionedDataset connecting partition IDs directly with the basic dataset path...