Threats affecting pkg:pypi/dagster-ge

A Local File Inclusion (LFI) vulnerability exists in Dagster version 1.10.14 and earlier versions, including several 0.10.x releases. The flaw is in the dagster._grpc.impl.get_notebook_data function, where attackers with access to the gRPC server can read arbitrary files by exploiting path traversal in the notebook_path field of ExternalNotebookData requests. This bypasses the intended extension-based file access checks.