Threat database

kedro-datasets versions 9.3.0 through 9.6.0 contain a path traversal vulnerability in the MatplotlibDataset.save() function. This flaw allows attackers with limited privileges to write files outside the intended dataset directory by supplying absolute plot names. The vulnerability arises because validate_sub_path() removes leading slashes, but pathlib's join discards the base path when given an absolute path, enabling arbitrary file creation or overwriting wherever the process has write permissions.

Kedro-Datasets versions from 5.0.0 up to but not including 9.5.0 contain a deserialization vulnerability in the experimental PyTorchDataset component. This component loads .pt model files using torch.load without enforcing the weights_only=True parameter, allowing maliciously crafted pickle-backed models to execute arbitrary code on PyTorch versions earlier than 2.6. The vulnerability only affects users who load untrusted model files via this opt-in component. The issue is resolved in version 9.5.0.

Kedro version 1.2.0 contains a path traversal vulnerability in the _get_versioned_path() method, which unsafely incorporates user-supplied version strings into filesystem paths. This flaw also affects the CLI via the --load-versions parameter, allowing crafted input to escape intended directories. Exploitation can lead to unauthorized file reads and cross-project data access.

CVE-2026-35492 is a path traversal vulnerability in the PartitionedDataset component of kedro-datasets, a plugin for kedro-plugins. Prior to version 9.3.0, the plugin concatenated partition IDs directly with the dataset base path without validating for path traversal sequences like '.. '. This flaw could allow an attacker to write files outside the intended dataset directory, potentially overwriting arbitrary files on the filesystem. The vulnerability affects all storage backends supported by PartitionedDataset, including local filesystems and cloud storage such as S3 and GCS. The issue is fixed in kedro-plugins version 9.3.0.

Kedro versions prior to 1.3.0 contain a critical remote code execution vulnerability due to unsafe loading of a logging configuration file specified by the KEDRO_LOGGING_CONFIG environment variable. The logging configuration supports a special key that allows arbitrary callable instantiation, enabling attackers to execute system commands during application startup. This vulnerability is fixed in Kedro version 1.3.0.

Kedro versions prior to 1.3.0 contain a path traversal vulnerability in the _get_versioned_path() method, which improperly handles user-supplied version strings. This allows an attacker who can control the version string to cause Kedro to load files outside the intended versioned dataset directory. The issue affects multiple entry points including catalog.load, DataCatalog.from_config, and the CLI. This vulnerability can lead to unauthorized file reads, data poisoning, or cross-tenant data access in shared environments. The vulnerability is fixed in Kedro version 1.3.

In kedro-org/kedro version 0.19.8, the `pull_package()` API function allows users to download and extract micro packages from the Internet. However, the function `project_wheel_metadata()` within the code path can execute the `setup.py` file inside the tar file, leading to remote code execution (RCE) by running arbitrary commands on the victim's machine.