Search

Find a vulnerability

Search criteria

    4 vulnerabilities found for kedro-plugins by kedro-org

    CVE-2026-62997 (GCVE-0-2026-62997)

    Vulnerability from nvd – Published: 2026-09-16 20:48 – Updated: 2026-09-17 14:55
    VLAI
    Title
    Kedro-Datasets: Remote code execution in experimental `PyTorchDataset` via unsafe `torch.load`
    Summary
    Kedro-Datasets provides data connectors for Kedro. From version 5.0.0 until 9.5.0, kedro_datasets_experimental.pytorch.PyTorchDataset in kedro-datasets loads .pt model files with torch.load without enforcing weights_only=True, and user-supplied load_args are silently dropped. On PyTorch versions earlier than 2.6, a malicious pickle-backed model from an attacker-influenced shared registry, downloaded checkpoint, or partitioned external source can execute arbitrary code when a Kedro pipeline loads it. The issue affects only the opt-in kedro_datasets_experimental component and does not affect users who load only trusted files. This issue is fixed in version 9.5.0.
    Severity
    7.7 (High)
    CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-09-17 14:55 UTC
    CWE
    • CWE-502 - Deserialization of Untrusted Data
    Assigner
    GitHub_M CNA under the mitre root
    CNA scorecard C 72/100 over 7909 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    kedro-org kedro-plugins Affected: >= 5.0.0, < 9.5.0
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-62997",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-17T14:55:10.455520Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-17T14:55:22.149Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "kedro-plugins",
          "vendor": "kedro-org",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 5.0.0, \u003c 9.5.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Kedro-Datasets provides data connectors for Kedro. From version 5.0.0 until 9.5.0, kedro_datasets_experimental.pytorch.PyTorchDataset in kedro-datasets loads .pt model files with torch.load without enforcing weights_only=True, and user-supplied load_args are silently dropped. On PyTorch versions earlier than 2.6, a malicious pickle-backed model from an attacker-influenced shared registry, downloaded checkpoint, or partitioned external source can execute arbitrary code when a Kedro pipeline loads it. The issue affects only the opt-in kedro_datasets_experimental component and does not affect users who load only trusted files. This issue is fixed in version 9.5.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-502",
              "description": "CWE-502: Deserialization of Untrusted Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-16T20:48:44.536Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/kedro-org/kedro-plugins/security/advisories/GHSA-f9q4-h45w-jrrq",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/kedro-org/kedro-plugins/security/advisories/GHSA-f9q4-h45w-jrrq"
        },
        {
          "name": "https://github.com/kedro-org/kedro-plugins/issues/1431",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kedro-org/kedro-plugins/issues/1431"
        },
        {
          "name": "https://github.com/kedro-org/kedro-plugins/pull/1433",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kedro-org/kedro-plugins/pull/1433"
        },
        {
          "name": "https://github.com/kedro-org/kedro-plugins/commit/4d6deb7a7ecba483d33fd43e2a6c063bcf22f413",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kedro-org/kedro-plugins/commit/4d6deb7a7ecba483d33fd43e2a6c063bcf22f413"
        },
        {
          "name": "https://github.com/kedro-org/kedro-plugins/releases/tag/kedro-datasets-9.5.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kedro-org/kedro-plugins/releases/tag/kedro-datasets-9.5.0"
        }
      ],
      "source": {
        "advisory": "GHSA-f9q4-h45w-jrrq",
        "discovery": "UNKNOWN"
      },
      "title": "Kedro-Datasets: Remote code execution in experimental `PyTorchDataset` via unsafe `torch.load`"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-62997",
    "datePublished": "2026-09-16T20:48:44.536Z",
    "dateReserved": "2026-07-14T23:10:57.032Z",
    "dateUpdated": "2026-09-17T14:55:22.149Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-35492 (GCVE-0-2026-35492)

    Vulnerability from nvd – Published: 2026-04-07 15:03 – Updated: 2026-04-08 14:50
    VLAI
    Title
    Kedro-Datasets has a path traversal vulnerability in PartitionedDataset allows arbitrary file write
    Summary
    Kedro-Datasets is a Kendo plugin providing data connectors. Prior to 9.3.0, PartitionedDataset in kedro-datasets was vulnerable to path traversal. Partition IDs were concatenated directly with the dataset base path without validation. An attacker or malicious input containing .. components in a partition ID could cause files to be written outside the configured dataset directory, potentially overwriting arbitrary files on the filesystem. Users of PartitionedDataset with any storage backend (local filesystem, S3, GCS, etc.) are affected. This vulnerability is fixed in 9.3.0.
    Severity
    6.5 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-04-08 14:49 UTC
    CWE
    • CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
    Assigner
    GitHub_M CNA under the mitre root
    CNA scorecard C 72/100 over 7909 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    kedro-org kedro-plugins Affected: < 9.3.0
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-35492",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-08T14:49:49.907338Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-08T14:50:03.601Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "kedro-plugins",
          "vendor": "kedro-org",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 9.3.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Kedro-Datasets is a Kendo plugin providing data connectors. Prior to 9.3.0, PartitionedDataset in kedro-datasets was vulnerable to path traversal. Partition IDs were concatenated directly with the dataset base path without validation. An attacker or malicious input containing .. components in a partition ID could cause files to be written outside the configured dataset directory, potentially overwriting arbitrary files on the filesystem. Users of PartitionedDataset with any storage backend (local filesystem, S3, GCS, etc.) are affected. This vulnerability is fixed in 9.3.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-07T15:03:45.893Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/kedro-org/kedro-plugins/security/advisories/GHSA-cjg8-h5qc-hrjv",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/kedro-org/kedro-plugins/security/advisories/GHSA-cjg8-h5qc-hrjv"
        },
        {
          "name": "https://github.com/kedro-org/kedro/issues/5452",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kedro-org/kedro/issues/5452"
        },
        {
          "name": "https://github.com/kedro-org/kedro-plugins/pull/1346",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kedro-org/kedro-plugins/pull/1346"
        }
      ],
      "source": {
        "advisory": "GHSA-cjg8-h5qc-hrjv",
        "discovery": "UNKNOWN"
      },
      "title": "Kedro-Datasets has a path traversal vulnerability in PartitionedDataset allows arbitrary file write"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-35492",
    "datePublished": "2026-04-07T15:03:45.893Z",
    "dateReserved": "2026-04-02T20:49:44.454Z",
    "dateUpdated": "2026-04-08T14:50:03.601Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-62997 (GCVE-0-2026-62997)

    Vulnerability from cvelistv5 – Published: 2026-09-16 20:48 – Updated: 2026-09-17 14:55
    VLAI
    Title
    Kedro-Datasets: Remote code execution in experimental `PyTorchDataset` via unsafe `torch.load`
    Summary
    Kedro-Datasets provides data connectors for Kedro. From version 5.0.0 until 9.5.0, kedro_datasets_experimental.pytorch.PyTorchDataset in kedro-datasets loads .pt model files with torch.load without enforcing weights_only=True, and user-supplied load_args are silently dropped. On PyTorch versions earlier than 2.6, a malicious pickle-backed model from an attacker-influenced shared registry, downloaded checkpoint, or partitioned external source can execute arbitrary code when a Kedro pipeline loads it. The issue affects only the opt-in kedro_datasets_experimental component and does not affect users who load only trusted files. This issue is fixed in version 9.5.0.
    Severity
    7.7 (High)
    CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-09-17 14:55 UTC
    CWE
    • CWE-502 - Deserialization of Untrusted Data
    Assigner
    GitHub_M CNA under the mitre root
    CNA scorecard C 72/100 over 7909 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    kedro-org kedro-plugins Affected: >= 5.0.0, < 9.5.0
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-62997",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-17T14:55:10.455520Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-17T14:55:22.149Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "kedro-plugins",
          "vendor": "kedro-org",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 5.0.0, \u003c 9.5.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Kedro-Datasets provides data connectors for Kedro. From version 5.0.0 until 9.5.0, kedro_datasets_experimental.pytorch.PyTorchDataset in kedro-datasets loads .pt model files with torch.load without enforcing weights_only=True, and user-supplied load_args are silently dropped. On PyTorch versions earlier than 2.6, a malicious pickle-backed model from an attacker-influenced shared registry, downloaded checkpoint, or partitioned external source can execute arbitrary code when a Kedro pipeline loads it. The issue affects only the opt-in kedro_datasets_experimental component and does not affect users who load only trusted files. This issue is fixed in version 9.5.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-502",
              "description": "CWE-502: Deserialization of Untrusted Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-16T20:48:44.536Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/kedro-org/kedro-plugins/security/advisories/GHSA-f9q4-h45w-jrrq",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/kedro-org/kedro-plugins/security/advisories/GHSA-f9q4-h45w-jrrq"
        },
        {
          "name": "https://github.com/kedro-org/kedro-plugins/issues/1431",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kedro-org/kedro-plugins/issues/1431"
        },
        {
          "name": "https://github.com/kedro-org/kedro-plugins/pull/1433",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kedro-org/kedro-plugins/pull/1433"
        },
        {
          "name": "https://github.com/kedro-org/kedro-plugins/commit/4d6deb7a7ecba483d33fd43e2a6c063bcf22f413",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kedro-org/kedro-plugins/commit/4d6deb7a7ecba483d33fd43e2a6c063bcf22f413"
        },
        {
          "name": "https://github.com/kedro-org/kedro-plugins/releases/tag/kedro-datasets-9.5.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kedro-org/kedro-plugins/releases/tag/kedro-datasets-9.5.0"
        }
      ],
      "source": {
        "advisory": "GHSA-f9q4-h45w-jrrq",
        "discovery": "UNKNOWN"
      },
      "title": "Kedro-Datasets: Remote code execution in experimental `PyTorchDataset` via unsafe `torch.load`"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-62997",
    "datePublished": "2026-09-16T20:48:44.536Z",
    "dateReserved": "2026-07-14T23:10:57.032Z",
    "dateUpdated": "2026-09-17T14:55:22.149Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-35492 (GCVE-0-2026-35492)

    Vulnerability from cvelistv5 – Published: 2026-04-07 15:03 – Updated: 2026-04-08 14:50
    VLAI
    Title
    Kedro-Datasets has a path traversal vulnerability in PartitionedDataset allows arbitrary file write
    Summary
    Kedro-Datasets is a Kendo plugin providing data connectors. Prior to 9.3.0, PartitionedDataset in kedro-datasets was vulnerable to path traversal. Partition IDs were concatenated directly with the dataset base path without validation. An attacker or malicious input containing .. components in a partition ID could cause files to be written outside the configured dataset directory, potentially overwriting arbitrary files on the filesystem. Users of PartitionedDataset with any storage backend (local filesystem, S3, GCS, etc.) are affected. This vulnerability is fixed in 9.3.0.
    Severity
    6.5 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-04-08 14:49 UTC
    CWE
    • CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
    Assigner
    GitHub_M CNA under the mitre root
    CNA scorecard C 72/100 over 7909 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    kedro-org kedro-plugins Affected: < 9.3.0
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-35492",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-08T14:49:49.907338Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-08T14:50:03.601Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "kedro-plugins",
          "vendor": "kedro-org",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 9.3.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Kedro-Datasets is a Kendo plugin providing data connectors. Prior to 9.3.0, PartitionedDataset in kedro-datasets was vulnerable to path traversal. Partition IDs were concatenated directly with the dataset base path without validation. An attacker or malicious input containing .. components in a partition ID could cause files to be written outside the configured dataset directory, potentially overwriting arbitrary files on the filesystem. Users of PartitionedDataset with any storage backend (local filesystem, S3, GCS, etc.) are affected. This vulnerability is fixed in 9.3.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-07T15:03:45.893Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/kedro-org/kedro-plugins/security/advisories/GHSA-cjg8-h5qc-hrjv",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/kedro-org/kedro-plugins/security/advisories/GHSA-cjg8-h5qc-hrjv"
        },
        {
          "name": "https://github.com/kedro-org/kedro/issues/5452",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kedro-org/kedro/issues/5452"
        },
        {
          "name": "https://github.com/kedro-org/kedro-plugins/pull/1346",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kedro-org/kedro-plugins/pull/1346"
        }
      ],
      "source": {
        "advisory": "GHSA-cjg8-h5qc-hrjv",
        "discovery": "UNKNOWN"
      },
      "title": "Kedro-Datasets has a path traversal vulnerability in PartitionedDataset allows arbitrary file write"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-35492",
    "datePublished": "2026-04-07T15:03:45.893Z",
    "dateReserved": "2026-04-02T20:49:44.454Z",
    "dateUpdated": "2026-04-08T14:50:03.601Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}