Executive brief
Kedro-Datasets is a library providing data connectors for the Kedro data pipeline framework. Versions 5.0.0 through 9.5.0 contain a deserialization vulnerability in the experimental PyTorchDataset component that can allow arbitrary code execution when loading untrusted .pt model files via pickle-based deserialization. This risk is elevated when pipelines load models from shared registries, external checkpoints, or untrusted sources.
Technical details
The vulnerability is a deserialization flaw in kedro_datasets_experimental.pytorch.PyTorchDataset, which loads PyTorch .pt files using torch.load() without enforcing the weights_only=True parameter and silently discards user-supplied load_args. On PyTorch versions prior to 2.6, this permits arbitrary code execution via malicious pickle-backed model files. The attack requires a network vector to influence model sources (shared registry, downloaded checkpoint, or partitioned external data). The vulnerability has been patched in version 9.5.0 by hardening torch.load() invocations with safer deserialization settings. The issue affects only the opt-in kedro_datasets_experimental component.
Affected products
- Kedro Kedro-Datasets 5.0.0 to 9.4.x
Timeline
- 2026-06-25: disclosed: Vulnerability reported on GitHub
- 2026-09-16: patched: Fixed in version 9.5.0
- 2026-09-16: advisory