Executive brief
Kedro, a data science framework, contains a vulnerability that allows users to access files outside of intended directories. By providing specially crafted version strings, an attacker could read sensitive system files or poison data used in data science pipelines. This could lead to unauthorized data exposure or compromised machine learning models in shared computing environments.
Technical details
A path traversal vulnerability exists in the `_get_versioned_path()` method within `kedro/io/core.py`. The component fails to sanitize user-supplied version strings before interpolating them into filesystem paths, allowing the use of `../` sequences. This is exploitable via `catalog.load()`, `DataCatalog.from_config()`, or the CLI using the `--load-versions` flag. An attacker with the ability to influence these inputs can read arbitrary files reachable by the application process or cause the application to load malicious datasets. The issue is resolved in Kedro version 1.3.0 by implementing version string validation.
Affected products
- Kedro-org Kedro < 1.3.0
Timeline
- 2026-03-10: patched: Fix merged in pull request 5442
- 2026-04-01: disclosed
- 2026-04-03: advisory: GitHub Advisory published
- 2026-04-06: other: NVD published date