{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"1.10.14"}],"component":"dagster-ge","cve_ids":["CVE-2025-51481"],"ecosystem":"PyPI","epss":0.00621,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-h7x8-jv97-fvvm","id":"tcs_01M5KGNKAVGZG60AHQPF6Q9N1N","modified_at":"2026-10-30T15:15:02.585259893Z","published_at":"2025-07-22T17:15:33.543Z","references":["https://osv.dev/vulnerability/PYSEC-2025-102","https://github.com/dagster-io/dagster/pull/30002","https://github.com/dagster-io/dagster","https://www.gecko.security/blog/cve-2025-51481"],"severity":{"label":"medium","score":6.6},"sources":[{"source":"osv","source_id":"PYSEC-2025-102","url":"https://osv.dev/vulnerability/PYSEC-2025-102"}],"summary":"Local File Inclusion in dagster._grpc.impl.get_notebook_data in Dagster 1.10.14 allows attackers with access to the gRPC server to read arbitrary files by supplying path traversal sequences in the not"}