PatchTheCEVCVE-2026-35167: Kedro is a toolbox for production-ready data science
38
Routine
HIGH 7.1WATCHLISTUPGRADE
CVE-2026-35167 is a high-severity flaw (CVSS 7.1) affecting kedro. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Kedro is a toolbox for production-ready data science. Prior to 1.3.0, the _get_versioned_path() method in kedro/io/core.py constructs filesystem paths by directly interpolating user-supplied version strings without sanitization. Because version strings are used as path components, traversal sequences such as ../ are preserved and can escape the intended versioned dataset directory. This is reachable through multiple entry points: catalog.load(...
Why this priority
- High severity
- On your watchlist
A fixed release or distro patch exists.
Risk facts
| CVSS score | 7.1 (High) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | Low |
| User interaction | None |
| EPSS exploit chance | 0.4% (top 66%) |
| CISA exploited list | No |
| Weakness | CWE-22 |
| Published | 2026-04-06 |
| Last modified | 2026-10-23 |
Publisher (CNA): GitHub, Inc. · Vendor: linuxfoundation
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
linuxfoundation kedro UPGRADE
Affected: < 1.3.0
Fixed in: 1.3.0
Safe to downgrade to: no unaffected older release
1. Check installed version
pip show kedro
2. UPGRADE to 1.3.0
pip install --upgrade "kedro>=1.3.0"
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.