CVE-2026-3840

Vulnerability

In Kedro version 1.2.0, the _get_versioned_path() method in kedro/io/core.py directly interpolates user-supplied version strings into filesystem paths without sanitization. This allows an attacker to escape the intended versioned dataset directory. The issue is also reachable through the CLI via the --load-versions parameter, as _split_load_versions() in kedro/framework/cli/utils.py does not validate the version string. [1]

Exploitation

An attacker needs to provide a crafted version string, either programmatically via the API or through the CLI --load-versions parameter. No authentication is required if the CLI is exposed or if the API accepts user input. The attacker can use path traversal sequences (e.g., ../) to navigate outside the intended directory.

Impact

Successful exploitation leads to unauthorized file reads, data poisoning, cross-project or cross-tenant data access, and broader downstream impacts in environments where Kedro is used with automation or orchestration layers. [1]

Mitigation

As of the publication date, no fix has been released. Users should avoid passing untrusted version strings to Kedro's API or CLI. The vendor has not yet provided a patched version. [1]