kedro
Kedro is a toolbox for production-ready data science. It uses software engineering best practices to help you create data engineering and data science pipelines that are reproducible, maintainable, and modular.
View on Github
Activity
- Latest release
- 5d ago
- Total releases
- 72
- Cadence
- ~39 days
- Last 12 months
- 8
Reach
- Stars
- 11.0k
Details
- License
- unknown
- First release
- May 16, 2019
| Version | Released | |
|---|---|---|
1.6.0
minor
| ||
1.5.0
minor
| ||
1.4.0
minor
| ||
1.3.1
patch
| ||
1.3.0
minor
| ||
1.2.0
minor
2 CVEs
CVE-2026-35171
PYSEC-2026-72
GHSA-9cqf-439c-j96r
Apr 06, 2026
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
Kedro is a toolbox for production-ready data science. Prior to 1.3.0, Kedro allows the logging configuration file path to be set via the KEDRO_LOGGING_CONFIG environment variable and loads it without validation. The logging configuration schema supports the special () key, which enables arbitrary callable instantiation. An attacker can exploit this to execute arbitrary system commands during application startup. This is a critical remote code execution (RCE) vulnerability caused by unsafe use of logging.config.dictConfig() with user-controlled input. This vulnerability is fixed in 1.3.0. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 55 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.10
0.19.11
0.19.12
0.19.13
0.19.14
0.19.15
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
0.19.9
1.0.0
1.0.0rc1
1.0.0rc2
1.0.0rc3
1.1.0
1.1.1
1.2.0
Fixed in
1.3.0
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-35167
PYSEC-2026-71
GHSA-6326-w46w-ppjw
Apr 06, 2026
8.1
/ 10
High
Network
Low
Low
None
Unchanged
High
High
None
Kedro is a toolbox for production-ready data science. Prior to 1.3.0, the _get_versioned_path() method in kedro/io/core.py constructs filesystem paths by directly interpolating user-supplied version strings without sanitization. Because version strings are used as path components, traversal sequences such as ../ are preserved and can escape the intended versioned dataset directory. This is reachable through multiple entry points: catalog.load(..., version=...), DataCatalog.from_config(..., load_versions=...), and the CLI via kedro run --load-versions=dataset:../../../secrets. An attacker who can influence the version string can force Kedro to load files from outside the intended version directory, enabling unauthorized file reads, data poisoning, or cross-tenant data access in shared environments. This vulnerability is fixed in 1.3.0. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 55 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.10
0.19.11
0.19.12
0.19.13
0.19.14
0.19.15
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
0.19.9
1.0.0
1.0.0rc1
1.0.0rc2
1.0.0rc3
1.1.0
1.1.1
1.2.0
Fixed in
1.3.0
References Updated May 20, 2026 · Source: OSV.dev | ||
1.1.1
patch
2 CVEs
CVE-2026-35171
PYSEC-2026-72
GHSA-9cqf-439c-j96r
Apr 06, 2026
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
Kedro is a toolbox for production-ready data science. Prior to 1.3.0, Kedro allows the logging configuration file path to be set via the KEDRO_LOGGING_CONFIG environment variable and loads it without validation. The logging configuration schema supports the special () key, which enables arbitrary callable instantiation. An attacker can exploit this to execute arbitrary system commands during application startup. This is a critical remote code execution (RCE) vulnerability caused by unsafe use of logging.config.dictConfig() with user-controlled input. This vulnerability is fixed in 1.3.0. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 55 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.10
0.19.11
0.19.12
0.19.13
0.19.14
0.19.15
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
0.19.9
1.0.0
1.0.0rc1
1.0.0rc2
1.0.0rc3
1.1.0
1.1.1
1.2.0
Fixed in
1.3.0
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-35167
PYSEC-2026-71
GHSA-6326-w46w-ppjw
Apr 06, 2026
8.1
/ 10
High
Network
Low
Low
None
Unchanged
High
High
None
Kedro is a toolbox for production-ready data science. Prior to 1.3.0, the _get_versioned_path() method in kedro/io/core.py constructs filesystem paths by directly interpolating user-supplied version strings without sanitization. Because version strings are used as path components, traversal sequences such as ../ are preserved and can escape the intended versioned dataset directory. This is reachable through multiple entry points: catalog.load(..., version=...), DataCatalog.from_config(..., load_versions=...), and the CLI via kedro run --load-versions=dataset:../../../secrets. An attacker who can influence the version string can force Kedro to load files from outside the intended version directory, enabling unauthorized file reads, data poisoning, or cross-tenant data access in shared environments. This vulnerability is fixed in 1.3.0. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 55 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.10
0.19.11
0.19.12
0.19.13
0.19.14
0.19.15
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
0.19.9
1.0.0
1.0.0rc1
1.0.0rc2
1.0.0rc3
1.1.0
1.1.1
1.2.0
Fixed in
1.3.0
References Updated May 20, 2026 · Source: OSV.dev | ||
1.1.0
minor
2 CVEs
CVE-2026-35171
PYSEC-2026-72
GHSA-9cqf-439c-j96r
Apr 06, 2026
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
Kedro is a toolbox for production-ready data science. Prior to 1.3.0, Kedro allows the logging configuration file path to be set via the KEDRO_LOGGING_CONFIG environment variable and loads it without validation. The logging configuration schema supports the special () key, which enables arbitrary callable instantiation. An attacker can exploit this to execute arbitrary system commands during application startup. This is a critical remote code execution (RCE) vulnerability caused by unsafe use of logging.config.dictConfig() with user-controlled input. This vulnerability is fixed in 1.3.0. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 55 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.10
0.19.11
0.19.12
0.19.13
0.19.14
0.19.15
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
0.19.9
1.0.0
1.0.0rc1
1.0.0rc2
1.0.0rc3
1.1.0
1.1.1
1.2.0
Fixed in
1.3.0
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-35167
PYSEC-2026-71
GHSA-6326-w46w-ppjw
Apr 06, 2026
8.1
/ 10
High
Network
Low
Low
None
Unchanged
High
High
None
Kedro is a toolbox for production-ready data science. Prior to 1.3.0, the _get_versioned_path() method in kedro/io/core.py constructs filesystem paths by directly interpolating user-supplied version strings without sanitization. Because version strings are used as path components, traversal sequences such as ../ are preserved and can escape the intended versioned dataset directory. This is reachable through multiple entry points: catalog.load(..., version=...), DataCatalog.from_config(..., load_versions=...), and the CLI via kedro run --load-versions=dataset:../../../secrets. An attacker who can influence the version string can force Kedro to load files from outside the intended version directory, enabling unauthorized file reads, data poisoning, or cross-tenant data access in shared environments. This vulnerability is fixed in 1.3.0. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 55 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.10
0.19.11
0.19.12
0.19.13
0.19.14
0.19.15
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
0.19.9
1.0.0
1.0.0rc1
1.0.0rc2
1.0.0rc3
1.1.0
1.1.1
1.2.0
Fixed in
1.3.0
References Updated May 20, 2026 · Source: OSV.dev | ||
0.19.15
patch
2 CVEs
CVE-2026-35171
PYSEC-2026-72
GHSA-9cqf-439c-j96r
Apr 06, 2026
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
Kedro is a toolbox for production-ready data science. Prior to 1.3.0, Kedro allows the logging configuration file path to be set via the KEDRO_LOGGING_CONFIG environment variable and loads it without validation. The logging configuration schema supports the special () key, which enables arbitrary callable instantiation. An attacker can exploit this to execute arbitrary system commands during application startup. This is a critical remote code execution (RCE) vulnerability caused by unsafe use of logging.config.dictConfig() with user-controlled input. This vulnerability is fixed in 1.3.0. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 55 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.10
0.19.11
0.19.12
0.19.13
0.19.14
0.19.15
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
0.19.9
1.0.0
1.0.0rc1
1.0.0rc2
1.0.0rc3
1.1.0
1.1.1
1.2.0
Fixed in
1.3.0
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-35167
PYSEC-2026-71
GHSA-6326-w46w-ppjw
Apr 06, 2026
8.1
/ 10
High
Network
Low
Low
None
Unchanged
High
High
None
Kedro is a toolbox for production-ready data science. Prior to 1.3.0, the _get_versioned_path() method in kedro/io/core.py constructs filesystem paths by directly interpolating user-supplied version strings without sanitization. Because version strings are used as path components, traversal sequences such as ../ are preserved and can escape the intended versioned dataset directory. This is reachable through multiple entry points: catalog.load(..., version=...), DataCatalog.from_config(..., load_versions=...), and the CLI via kedro run --load-versions=dataset:../../../secrets. An attacker who can influence the version string can force Kedro to load files from outside the intended version directory, enabling unauthorized file reads, data poisoning, or cross-tenant data access in shared environments. This vulnerability is fixed in 1.3.0. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 55 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.10
0.19.11
0.19.12
0.19.13
0.19.14
0.19.15
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
0.19.9
1.0.0
1.0.0rc1
1.0.0rc2
1.0.0rc3
1.1.0
1.1.1
1.2.0
Fixed in
1.3.0
References Updated May 20, 2026 · Source: OSV.dev | ||
1.0.0
major
2 CVEs
CVE-2026-35171
PYSEC-2026-72
GHSA-9cqf-439c-j96r
Apr 06, 2026
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
Kedro is a toolbox for production-ready data science. Prior to 1.3.0, Kedro allows the logging configuration file path to be set via the KEDRO_LOGGING_CONFIG environment variable and loads it without validation. The logging configuration schema supports the special () key, which enables arbitrary callable instantiation. An attacker can exploit this to execute arbitrary system commands during application startup. This is a critical remote code execution (RCE) vulnerability caused by unsafe use of logging.config.dictConfig() with user-controlled input. This vulnerability is fixed in 1.3.0. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 55 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.10
0.19.11
0.19.12
0.19.13
0.19.14
0.19.15
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
0.19.9
1.0.0
1.0.0rc1
1.0.0rc2
1.0.0rc3
1.1.0
1.1.1
1.2.0
Fixed in
1.3.0
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-35167
PYSEC-2026-71
GHSA-6326-w46w-ppjw
Apr 06, 2026
8.1
/ 10
High
Network
Low
Low
None
Unchanged
High
High
None
Kedro is a toolbox for production-ready data science. Prior to 1.3.0, the _get_versioned_path() method in kedro/io/core.py constructs filesystem paths by directly interpolating user-supplied version strings without sanitization. Because version strings are used as path components, traversal sequences such as ../ are preserved and can escape the intended versioned dataset directory. This is reachable through multiple entry points: catalog.load(..., version=...), DataCatalog.from_config(..., load_versions=...), and the CLI via kedro run --load-versions=dataset:../../../secrets. An attacker who can influence the version string can force Kedro to load files from outside the intended version directory, enabling unauthorized file reads, data poisoning, or cross-tenant data access in shared environments. This vulnerability is fixed in 1.3.0. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 55 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.10
0.19.11
0.19.12
0.19.13
0.19.14
0.19.15
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
0.19.9
1.0.0
1.0.0rc1
1.0.0rc2
1.0.0rc3
1.1.0
1.1.1
1.2.0
Fixed in
1.3.0
References Updated May 20, 2026 · Source: OSV.dev | ||
1.0.0rc3
pre
2 CVEs
CVE-2026-35171
PYSEC-2026-72
GHSA-9cqf-439c-j96r
Apr 06, 2026
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
Kedro is a toolbox for production-ready data science. Prior to 1.3.0, Kedro allows the logging configuration file path to be set via the KEDRO_LOGGING_CONFIG environment variable and loads it without validation. The logging configuration schema supports the special () key, which enables arbitrary callable instantiation. An attacker can exploit this to execute arbitrary system commands during application startup. This is a critical remote code execution (RCE) vulnerability caused by unsafe use of logging.config.dictConfig() with user-controlled input. This vulnerability is fixed in 1.3.0. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 55 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.10
0.19.11
0.19.12
0.19.13
0.19.14
0.19.15
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
0.19.9
1.0.0
1.0.0rc1
1.0.0rc2
1.0.0rc3
1.1.0
1.1.1
1.2.0
Fixed in
1.3.0
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-35167
PYSEC-2026-71
GHSA-6326-w46w-ppjw
Apr 06, 2026
8.1
/ 10
High
Network
Low
Low
None
Unchanged
High
High
None
Kedro is a toolbox for production-ready data science. Prior to 1.3.0, the _get_versioned_path() method in kedro/io/core.py constructs filesystem paths by directly interpolating user-supplied version strings without sanitization. Because version strings are used as path components, traversal sequences such as ../ are preserved and can escape the intended versioned dataset directory. This is reachable through multiple entry points: catalog.load(..., version=...), DataCatalog.from_config(..., load_versions=...), and the CLI via kedro run --load-versions=dataset:../../../secrets. An attacker who can influence the version string can force Kedro to load files from outside the intended version directory, enabling unauthorized file reads, data poisoning, or cross-tenant data access in shared environments. This vulnerability is fixed in 1.3.0. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 55 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.10
0.19.11
0.19.12
0.19.13
0.19.14
0.19.15
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
0.19.9
1.0.0
1.0.0rc1
1.0.0rc2
1.0.0rc3
1.1.0
1.1.1
1.2.0
Fixed in
1.3.0
References Updated May 20, 2026 · Source: OSV.dev | ||
1.0.0rc2
pre
2 CVEs
CVE-2026-35171
PYSEC-2026-72
GHSA-9cqf-439c-j96r
Apr 06, 2026
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
Kedro is a toolbox for production-ready data science. Prior to 1.3.0, Kedro allows the logging configuration file path to be set via the KEDRO_LOGGING_CONFIG environment variable and loads it without validation. The logging configuration schema supports the special () key, which enables arbitrary callable instantiation. An attacker can exploit this to execute arbitrary system commands during application startup. This is a critical remote code execution (RCE) vulnerability caused by unsafe use of logging.config.dictConfig() with user-controlled input. This vulnerability is fixed in 1.3.0. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 55 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.10
0.19.11
0.19.12
0.19.13
0.19.14
0.19.15
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
0.19.9
1.0.0
1.0.0rc1
1.0.0rc2
1.0.0rc3
1.1.0
1.1.1
1.2.0
Fixed in
1.3.0
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-35167
PYSEC-2026-71
GHSA-6326-w46w-ppjw
Apr 06, 2026
8.1
/ 10
High
Network
Low
Low
None
Unchanged
High
High
None
Kedro is a toolbox for production-ready data science. Prior to 1.3.0, the _get_versioned_path() method in kedro/io/core.py constructs filesystem paths by directly interpolating user-supplied version strings without sanitization. Because version strings are used as path components, traversal sequences such as ../ are preserved and can escape the intended versioned dataset directory. This is reachable through multiple entry points: catalog.load(..., version=...), DataCatalog.from_config(..., load_versions=...), and the CLI via kedro run --load-versions=dataset:../../../secrets. An attacker who can influence the version string can force Kedro to load files from outside the intended version directory, enabling unauthorized file reads, data poisoning, or cross-tenant data access in shared environments. This vulnerability is fixed in 1.3.0. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 55 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.10
0.19.11
0.19.12
0.19.13
0.19.14
0.19.15
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
0.19.9
1.0.0
1.0.0rc1
1.0.0rc2
1.0.0rc3
1.1.0
1.1.1
1.2.0
Fixed in
1.3.0
References Updated May 20, 2026 · Source: OSV.dev | ||
1.0.0rc1
pre
2 CVEs
CVE-2026-35171
PYSEC-2026-72
GHSA-9cqf-439c-j96r
Apr 06, 2026
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
Kedro is a toolbox for production-ready data science. Prior to 1.3.0, Kedro allows the logging configuration file path to be set via the KEDRO_LOGGING_CONFIG environment variable and loads it without validation. The logging configuration schema supports the special () key, which enables arbitrary callable instantiation. An attacker can exploit this to execute arbitrary system commands during application startup. This is a critical remote code execution (RCE) vulnerability caused by unsafe use of logging.config.dictConfig() with user-controlled input. This vulnerability is fixed in 1.3.0. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 55 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.10
0.19.11
0.19.12
0.19.13
0.19.14
0.19.15
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
0.19.9
1.0.0
1.0.0rc1
1.0.0rc2
1.0.0rc3
1.1.0
1.1.1
1.2.0
Fixed in
1.3.0
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-35167
PYSEC-2026-71
GHSA-6326-w46w-ppjw
Apr 06, 2026
8.1
/ 10
High
Network
Low
Low
None
Unchanged
High
High
None
Kedro is a toolbox for production-ready data science. Prior to 1.3.0, the _get_versioned_path() method in kedro/io/core.py constructs filesystem paths by directly interpolating user-supplied version strings without sanitization. Because version strings are used as path components, traversal sequences such as ../ are preserved and can escape the intended versioned dataset directory. This is reachable through multiple entry points: catalog.load(..., version=...), DataCatalog.from_config(..., load_versions=...), and the CLI via kedro run --load-versions=dataset:../../../secrets. An attacker who can influence the version string can force Kedro to load files from outside the intended version directory, enabling unauthorized file reads, data poisoning, or cross-tenant data access in shared environments. This vulnerability is fixed in 1.3.0. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 55 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.10
0.19.11
0.19.12
0.19.13
0.19.14
0.19.15
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
0.19.9
1.0.0
1.0.0rc1
1.0.0rc2
1.0.0rc3
1.1.0
1.1.1
1.2.0
Fixed in
1.3.0
References Updated May 20, 2026 · Source: OSV.dev | ||
0.19.14
patch
2 CVEs
CVE-2026-35171
PYSEC-2026-72
GHSA-9cqf-439c-j96r
Apr 06, 2026
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
Kedro is a toolbox for production-ready data science. Prior to 1.3.0, Kedro allows the logging configuration file path to be set via the KEDRO_LOGGING_CONFIG environment variable and loads it without validation. The logging configuration schema supports the special () key, which enables arbitrary callable instantiation. An attacker can exploit this to execute arbitrary system commands during application startup. This is a critical remote code execution (RCE) vulnerability caused by unsafe use of logging.config.dictConfig() with user-controlled input. This vulnerability is fixed in 1.3.0. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 55 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.10
0.19.11
0.19.12
0.19.13
0.19.14
0.19.15
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
0.19.9
1.0.0
1.0.0rc1
1.0.0rc2
1.0.0rc3
1.1.0
1.1.1
1.2.0
Fixed in
1.3.0
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-35167
PYSEC-2026-71
GHSA-6326-w46w-ppjw
Apr 06, 2026
8.1
/ 10
High
Network
Low
Low
None
Unchanged
High
High
None
Kedro is a toolbox for production-ready data science. Prior to 1.3.0, the _get_versioned_path() method in kedro/io/core.py constructs filesystem paths by directly interpolating user-supplied version strings without sanitization. Because version strings are used as path components, traversal sequences such as ../ are preserved and can escape the intended versioned dataset directory. This is reachable through multiple entry points: catalog.load(..., version=...), DataCatalog.from_config(..., load_versions=...), and the CLI via kedro run --load-versions=dataset:../../../secrets. An attacker who can influence the version string can force Kedro to load files from outside the intended version directory, enabling unauthorized file reads, data poisoning, or cross-tenant data access in shared environments. This vulnerability is fixed in 1.3.0. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 55 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.10
0.19.11
0.19.12
0.19.13
0.19.14
0.19.15
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
0.19.9
1.0.0
1.0.0rc1
1.0.0rc2
1.0.0rc3
1.1.0
1.1.1
1.2.0
Fixed in
1.3.0
References Updated May 20, 2026 · Source: OSV.dev | ||
0.19.13
patch
2 CVEs
CVE-2026-35171
PYSEC-2026-72
GHSA-9cqf-439c-j96r
Apr 06, 2026
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
Kedro is a toolbox for production-ready data science. Prior to 1.3.0, Kedro allows the logging configuration file path to be set via the KEDRO_LOGGING_CONFIG environment variable and loads it without validation. The logging configuration schema supports the special () key, which enables arbitrary callable instantiation. An attacker can exploit this to execute arbitrary system commands during application startup. This is a critical remote code execution (RCE) vulnerability caused by unsafe use of logging.config.dictConfig() with user-controlled input. This vulnerability is fixed in 1.3.0. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 55 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.10
0.19.11
0.19.12
0.19.13
0.19.14
0.19.15
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
0.19.9
1.0.0
1.0.0rc1
1.0.0rc2
1.0.0rc3
1.1.0
1.1.1
1.2.0
Fixed in
1.3.0
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-35167
PYSEC-2026-71
GHSA-6326-w46w-ppjw
Apr 06, 2026
8.1
/ 10
High
Network
Low
Low
None
Unchanged
High
High
None
Kedro is a toolbox for production-ready data science. Prior to 1.3.0, the _get_versioned_path() method in kedro/io/core.py constructs filesystem paths by directly interpolating user-supplied version strings without sanitization. Because version strings are used as path components, traversal sequences such as ../ are preserved and can escape the intended versioned dataset directory. This is reachable through multiple entry points: catalog.load(..., version=...), DataCatalog.from_config(..., load_versions=...), and the CLI via kedro run --load-versions=dataset:../../../secrets. An attacker who can influence the version string can force Kedro to load files from outside the intended version directory, enabling unauthorized file reads, data poisoning, or cross-tenant data access in shared environments. This vulnerability is fixed in 1.3.0. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 55 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.10
0.19.11
0.19.12
0.19.13
0.19.14
0.19.15
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
0.19.9
1.0.0
1.0.0rc1
1.0.0rc2
1.0.0rc3
1.1.0
1.1.1
1.2.0
Fixed in
1.3.0
References Updated May 20, 2026 · Source: OSV.dev | ||
0.19.12
patch
2 CVEs
CVE-2026-35171
PYSEC-2026-72
GHSA-9cqf-439c-j96r
Apr 06, 2026
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
Kedro is a toolbox for production-ready data science. Prior to 1.3.0, Kedro allows the logging configuration file path to be set via the KEDRO_LOGGING_CONFIG environment variable and loads it without validation. The logging configuration schema supports the special () key, which enables arbitrary callable instantiation. An attacker can exploit this to execute arbitrary system commands during application startup. This is a critical remote code execution (RCE) vulnerability caused by unsafe use of logging.config.dictConfig() with user-controlled input. This vulnerability is fixed in 1.3.0. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 55 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.10
0.19.11
0.19.12
0.19.13
0.19.14
0.19.15
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
0.19.9
1.0.0
1.0.0rc1
1.0.0rc2
1.0.0rc3
1.1.0
1.1.1
1.2.0
Fixed in
1.3.0
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-35167
PYSEC-2026-71
GHSA-6326-w46w-ppjw
Apr 06, 2026
8.1
/ 10
High
Network
Low
Low
None
Unchanged
High
High
None
Kedro is a toolbox for production-ready data science. Prior to 1.3.0, the _get_versioned_path() method in kedro/io/core.py constructs filesystem paths by directly interpolating user-supplied version strings without sanitization. Because version strings are used as path components, traversal sequences such as ../ are preserved and can escape the intended versioned dataset directory. This is reachable through multiple entry points: catalog.load(..., version=...), DataCatalog.from_config(..., load_versions=...), and the CLI via kedro run --load-versions=dataset:../../../secrets. An attacker who can influence the version string can force Kedro to load files from outside the intended version directory, enabling unauthorized file reads, data poisoning, or cross-tenant data access in shared environments. This vulnerability is fixed in 1.3.0. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 55 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.10
0.19.11
0.19.12
0.19.13
0.19.14
0.19.15
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
0.19.9
1.0.0
1.0.0rc1
1.0.0rc2
1.0.0rc3
1.1.0
1.1.1
1.2.0
Fixed in
1.3.0
References Updated May 20, 2026 · Source: OSV.dev | ||
0.19.11
patch
2 CVEs
CVE-2026-35171
PYSEC-2026-72
GHSA-9cqf-439c-j96r
Apr 06, 2026
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
Kedro is a toolbox for production-ready data science. Prior to 1.3.0, Kedro allows the logging configuration file path to be set via the KEDRO_LOGGING_CONFIG environment variable and loads it without validation. The logging configuration schema supports the special () key, which enables arbitrary callable instantiation. An attacker can exploit this to execute arbitrary system commands during application startup. This is a critical remote code execution (RCE) vulnerability caused by unsafe use of logging.config.dictConfig() with user-controlled input. This vulnerability is fixed in 1.3.0. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 55 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.10
0.19.11
0.19.12
0.19.13
0.19.14
0.19.15
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
0.19.9
1.0.0
1.0.0rc1
1.0.0rc2
1.0.0rc3
1.1.0
1.1.1
1.2.0
Fixed in
1.3.0
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-35167
PYSEC-2026-71
GHSA-6326-w46w-ppjw
Apr 06, 2026
8.1
/ 10
High
Network
Low
Low
None
Unchanged
High
High
None
Kedro is a toolbox for production-ready data science. Prior to 1.3.0, the _get_versioned_path() method in kedro/io/core.py constructs filesystem paths by directly interpolating user-supplied version strings without sanitization. Because version strings are used as path components, traversal sequences such as ../ are preserved and can escape the intended versioned dataset directory. This is reachable through multiple entry points: catalog.load(..., version=...), DataCatalog.from_config(..., load_versions=...), and the CLI via kedro run --load-versions=dataset:../../../secrets. An attacker who can influence the version string can force Kedro to load files from outside the intended version directory, enabling unauthorized file reads, data poisoning, or cross-tenant data access in shared environments. This vulnerability is fixed in 1.3.0. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 55 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.10
0.19.11
0.19.12
0.19.13
0.19.14
0.19.15
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
0.19.9
1.0.0
1.0.0rc1
1.0.0rc2
1.0.0rc3
1.1.0
1.1.1
1.2.0
Fixed in
1.3.0
References Updated May 20, 2026 · Source: OSV.dev | ||
0.19.10
patch
2 CVEs
CVE-2026-35171
PYSEC-2026-72
GHSA-9cqf-439c-j96r
Apr 06, 2026
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
Kedro is a toolbox for production-ready data science. Prior to 1.3.0, Kedro allows the logging configuration file path to be set via the KEDRO_LOGGING_CONFIG environment variable and loads it without validation. The logging configuration schema supports the special () key, which enables arbitrary callable instantiation. An attacker can exploit this to execute arbitrary system commands during application startup. This is a critical remote code execution (RCE) vulnerability caused by unsafe use of logging.config.dictConfig() with user-controlled input. This vulnerability is fixed in 1.3.0. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 55 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.10
0.19.11
0.19.12
0.19.13
0.19.14
0.19.15
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
0.19.9
1.0.0
1.0.0rc1
1.0.0rc2
1.0.0rc3
1.1.0
1.1.1
1.2.0
Fixed in
1.3.0
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-35167
PYSEC-2026-71
GHSA-6326-w46w-ppjw
Apr 06, 2026
8.1
/ 10
High
Network
Low
Low
None
Unchanged
High
High
None
Kedro is a toolbox for production-ready data science. Prior to 1.3.0, the _get_versioned_path() method in kedro/io/core.py constructs filesystem paths by directly interpolating user-supplied version strings without sanitization. Because version strings are used as path components, traversal sequences such as ../ are preserved and can escape the intended versioned dataset directory. This is reachable through multiple entry points: catalog.load(..., version=...), DataCatalog.from_config(..., load_versions=...), and the CLI via kedro run --load-versions=dataset:../../../secrets. An attacker who can influence the version string can force Kedro to load files from outside the intended version directory, enabling unauthorized file reads, data poisoning, or cross-tenant data access in shared environments. This vulnerability is fixed in 1.3.0. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 55 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.10
0.19.11
0.19.12
0.19.13
0.19.14
0.19.15
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
0.19.9
1.0.0
1.0.0rc1
1.0.0rc2
1.0.0rc3
1.1.0
1.1.1
1.2.0
Fixed in
1.3.0
References Updated May 20, 2026 · Source: OSV.dev | ||
0.19.9
patch
2 CVEs
CVE-2026-35171
PYSEC-2026-72
GHSA-9cqf-439c-j96r
Apr 06, 2026
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
Kedro is a toolbox for production-ready data science. Prior to 1.3.0, Kedro allows the logging configuration file path to be set via the KEDRO_LOGGING_CONFIG environment variable and loads it without validation. The logging configuration schema supports the special () key, which enables arbitrary callable instantiation. An attacker can exploit this to execute arbitrary system commands during application startup. This is a critical remote code execution (RCE) vulnerability caused by unsafe use of logging.config.dictConfig() with user-controlled input. This vulnerability is fixed in 1.3.0. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 55 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.10
0.19.11
0.19.12
0.19.13
0.19.14
0.19.15
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
0.19.9
1.0.0
1.0.0rc1
1.0.0rc2
1.0.0rc3
1.1.0
1.1.1
1.2.0
Fixed in
1.3.0
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-35167
PYSEC-2026-71
GHSA-6326-w46w-ppjw
Apr 06, 2026
8.1
/ 10
High
Network
Low
Low
None
Unchanged
High
High
None
Kedro is a toolbox for production-ready data science. Prior to 1.3.0, the _get_versioned_path() method in kedro/io/core.py constructs filesystem paths by directly interpolating user-supplied version strings without sanitization. Because version strings are used as path components, traversal sequences such as ../ are preserved and can escape the intended versioned dataset directory. This is reachable through multiple entry points: catalog.load(..., version=...), DataCatalog.from_config(..., load_versions=...), and the CLI via kedro run --load-versions=dataset:../../../secrets. An attacker who can influence the version string can force Kedro to load files from outside the intended version directory, enabling unauthorized file reads, data poisoning, or cross-tenant data access in shared environments. This vulnerability is fixed in 1.3.0. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 55 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.10
0.19.11
0.19.12
0.19.13
0.19.14
0.19.15
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
0.19.9
1.0.0
1.0.0rc1
1.0.0rc2
1.0.0rc3
1.1.0
1.1.1
1.2.0
Fixed in
1.3.0
References Updated May 20, 2026 · Source: OSV.dev | ||
0.19.8
patch
4 CVEs
CVE-2024-12215
PYSEC-2026-1485
GHSA-rm69-wvpv-r2w7
Jul 07, 2026
Kedro allows Remote Code Execution by Pulling Micro Packages
8.8
/ 10
High
Network
Low
None
Required
Unchanged
High
High
High
In kedro-org/kedro version 0.19.8, the Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 41 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-9701
PYSEC-2026-367
GHSA-747f-ww56-4q4h
Jun 29, 2026
Kedro deserialization vulnerability
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
A Remote Code Execution (RCE) vulnerability has been identified in the Kedro ShelveStore class (version 0.19.8). This vulnerability allows an attacker to execute arbitrary Python code via deserialization of malicious payloads, potentially leading to a full system compromise. The ShelveStore class uses Python's shelve module to manage session data, which relies on pickle for serialization. Crafting a malicious payload and storing it in the shelve file can lead to RCE when the payload is deserialized. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 41 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
Fixed in
0.19.9
References
Updated Jul 01, 2026 · Source: OSV.dev
CVE-2026-35171
PYSEC-2026-72
GHSA-9cqf-439c-j96r
Apr 06, 2026
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
Kedro is a toolbox for production-ready data science. Prior to 1.3.0, Kedro allows the logging configuration file path to be set via the KEDRO_LOGGING_CONFIG environment variable and loads it without validation. The logging configuration schema supports the special () key, which enables arbitrary callable instantiation. An attacker can exploit this to execute arbitrary system commands during application startup. This is a critical remote code execution (RCE) vulnerability caused by unsafe use of logging.config.dictConfig() with user-controlled input. This vulnerability is fixed in 1.3.0. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 55 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.10
0.19.11
0.19.12
0.19.13
0.19.14
0.19.15
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
0.19.9
1.0.0
1.0.0rc1
1.0.0rc2
1.0.0rc3
1.1.0
1.1.1
1.2.0
Fixed in
1.3.0
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-35167
PYSEC-2026-71
GHSA-6326-w46w-ppjw
Apr 06, 2026
8.1
/ 10
High
Network
Low
Low
None
Unchanged
High
High
None
Kedro is a toolbox for production-ready data science. Prior to 1.3.0, the _get_versioned_path() method in kedro/io/core.py constructs filesystem paths by directly interpolating user-supplied version strings without sanitization. Because version strings are used as path components, traversal sequences such as ../ are preserved and can escape the intended versioned dataset directory. This is reachable through multiple entry points: catalog.load(..., version=...), DataCatalog.from_config(..., load_versions=...), and the CLI via kedro run --load-versions=dataset:../../../secrets. An attacker who can influence the version string can force Kedro to load files from outside the intended version directory, enabling unauthorized file reads, data poisoning, or cross-tenant data access in shared environments. This vulnerability is fixed in 1.3.0. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 55 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.10
0.19.11
0.19.12
0.19.13
0.19.14
0.19.15
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
0.19.9
1.0.0
1.0.0rc1
1.0.0rc2
1.0.0rc3
1.1.0
1.1.1
1.2.0
Fixed in
1.3.0
References Updated May 20, 2026 · Source: OSV.dev | ||
0.19.7
patch
4 CVEs
CVE-2024-12215
PYSEC-2026-1485
GHSA-rm69-wvpv-r2w7
Jul 07, 2026
Kedro allows Remote Code Execution by Pulling Micro Packages
8.8
/ 10
High
Network
Low
None
Required
Unchanged
High
High
High
In kedro-org/kedro version 0.19.8, the Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 41 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-9701
PYSEC-2026-367
GHSA-747f-ww56-4q4h
Jun 29, 2026
Kedro deserialization vulnerability
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
A Remote Code Execution (RCE) vulnerability has been identified in the Kedro ShelveStore class (version 0.19.8). This vulnerability allows an attacker to execute arbitrary Python code via deserialization of malicious payloads, potentially leading to a full system compromise. The ShelveStore class uses Python's shelve module to manage session data, which relies on pickle for serialization. Crafting a malicious payload and storing it in the shelve file can lead to RCE when the payload is deserialized. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 41 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
Fixed in
0.19.9
References
Updated Jul 01, 2026 · Source: OSV.dev
CVE-2026-35171
PYSEC-2026-72
GHSA-9cqf-439c-j96r
Apr 06, 2026
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
Kedro is a toolbox for production-ready data science. Prior to 1.3.0, Kedro allows the logging configuration file path to be set via the KEDRO_LOGGING_CONFIG environment variable and loads it without validation. The logging configuration schema supports the special () key, which enables arbitrary callable instantiation. An attacker can exploit this to execute arbitrary system commands during application startup. This is a critical remote code execution (RCE) vulnerability caused by unsafe use of logging.config.dictConfig() with user-controlled input. This vulnerability is fixed in 1.3.0. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 55 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.10
0.19.11
0.19.12
0.19.13
0.19.14
0.19.15
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
0.19.9
1.0.0
1.0.0rc1
1.0.0rc2
1.0.0rc3
1.1.0
1.1.1
1.2.0
Fixed in
1.3.0
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-35167
PYSEC-2026-71
GHSA-6326-w46w-ppjw
Apr 06, 2026
8.1
/ 10
High
Network
Low
Low
None
Unchanged
High
High
None
Kedro is a toolbox for production-ready data science. Prior to 1.3.0, the _get_versioned_path() method in kedro/io/core.py constructs filesystem paths by directly interpolating user-supplied version strings without sanitization. Because version strings are used as path components, traversal sequences such as ../ are preserved and can escape the intended versioned dataset directory. This is reachable through multiple entry points: catalog.load(..., version=...), DataCatalog.from_config(..., load_versions=...), and the CLI via kedro run --load-versions=dataset:../../../secrets. An attacker who can influence the version string can force Kedro to load files from outside the intended version directory, enabling unauthorized file reads, data poisoning, or cross-tenant data access in shared environments. This vulnerability is fixed in 1.3.0. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 55 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.10
0.19.11
0.19.12
0.19.13
0.19.14
0.19.15
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
0.19.9
1.0.0
1.0.0rc1
1.0.0rc2
1.0.0rc3
1.1.0
1.1.1
1.2.0
Fixed in
1.3.0
References Updated May 20, 2026 · Source: OSV.dev | ||
0.19.6
patch
4 CVEs
CVE-2024-12215
PYSEC-2026-1485
GHSA-rm69-wvpv-r2w7
Jul 07, 2026
Kedro allows Remote Code Execution by Pulling Micro Packages
8.8
/ 10
High
Network
Low
None
Required
Unchanged
High
High
High
In kedro-org/kedro version 0.19.8, the Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 41 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-9701
PYSEC-2026-367
GHSA-747f-ww56-4q4h
Jun 29, 2026
Kedro deserialization vulnerability
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
A Remote Code Execution (RCE) vulnerability has been identified in the Kedro ShelveStore class (version 0.19.8). This vulnerability allows an attacker to execute arbitrary Python code via deserialization of malicious payloads, potentially leading to a full system compromise. The ShelveStore class uses Python's shelve module to manage session data, which relies on pickle for serialization. Crafting a malicious payload and storing it in the shelve file can lead to RCE when the payload is deserialized. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 41 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
Fixed in
0.19.9
References
Updated Jul 01, 2026 · Source: OSV.dev
CVE-2026-35171
PYSEC-2026-72
GHSA-9cqf-439c-j96r
Apr 06, 2026
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
Kedro is a toolbox for production-ready data science. Prior to 1.3.0, Kedro allows the logging configuration file path to be set via the KEDRO_LOGGING_CONFIG environment variable and loads it without validation. The logging configuration schema supports the special () key, which enables arbitrary callable instantiation. An attacker can exploit this to execute arbitrary system commands during application startup. This is a critical remote code execution (RCE) vulnerability caused by unsafe use of logging.config.dictConfig() with user-controlled input. This vulnerability is fixed in 1.3.0. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 55 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.10
0.19.11
0.19.12
0.19.13
0.19.14
0.19.15
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
0.19.9
1.0.0
1.0.0rc1
1.0.0rc2
1.0.0rc3
1.1.0
1.1.1
1.2.0
Fixed in
1.3.0
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-35167
PYSEC-2026-71
GHSA-6326-w46w-ppjw
Apr 06, 2026
8.1
/ 10
High
Network
Low
Low
None
Unchanged
High
High
None
Kedro is a toolbox for production-ready data science. Prior to 1.3.0, the _get_versioned_path() method in kedro/io/core.py constructs filesystem paths by directly interpolating user-supplied version strings without sanitization. Because version strings are used as path components, traversal sequences such as ../ are preserved and can escape the intended versioned dataset directory. This is reachable through multiple entry points: catalog.load(..., version=...), DataCatalog.from_config(..., load_versions=...), and the CLI via kedro run --load-versions=dataset:../../../secrets. An attacker who can influence the version string can force Kedro to load files from outside the intended version directory, enabling unauthorized file reads, data poisoning, or cross-tenant data access in shared environments. This vulnerability is fixed in 1.3.0. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 55 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.10
0.19.11
0.19.12
0.19.13
0.19.14
0.19.15
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
0.19.9
1.0.0
1.0.0rc1
1.0.0rc2
1.0.0rc3
1.1.0
1.1.1
1.2.0
Fixed in
1.3.0
References Updated May 20, 2026 · Source: OSV.dev | ||
0.19.5
patch
4 CVEs
CVE-2024-12215
PYSEC-2026-1485
GHSA-rm69-wvpv-r2w7
Jul 07, 2026
Kedro allows Remote Code Execution by Pulling Micro Packages
8.8
/ 10
High
Network
Low
None
Required
Unchanged
High
High
High
In kedro-org/kedro version 0.19.8, the Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 41 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-9701
PYSEC-2026-367
GHSA-747f-ww56-4q4h
Jun 29, 2026
Kedro deserialization vulnerability
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
A Remote Code Execution (RCE) vulnerability has been identified in the Kedro ShelveStore class (version 0.19.8). This vulnerability allows an attacker to execute arbitrary Python code via deserialization of malicious payloads, potentially leading to a full system compromise. The ShelveStore class uses Python's shelve module to manage session data, which relies on pickle for serialization. Crafting a malicious payload and storing it in the shelve file can lead to RCE when the payload is deserialized. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 41 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
Fixed in
0.19.9
References
Updated Jul 01, 2026 · Source: OSV.dev
CVE-2026-35171
PYSEC-2026-72
GHSA-9cqf-439c-j96r
Apr 06, 2026
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
Kedro is a toolbox for production-ready data science. Prior to 1.3.0, Kedro allows the logging configuration file path to be set via the KEDRO_LOGGING_CONFIG environment variable and loads it without validation. The logging configuration schema supports the special () key, which enables arbitrary callable instantiation. An attacker can exploit this to execute arbitrary system commands during application startup. This is a critical remote code execution (RCE) vulnerability caused by unsafe use of logging.config.dictConfig() with user-controlled input. This vulnerability is fixed in 1.3.0. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 55 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.10
0.19.11
0.19.12
0.19.13
0.19.14
0.19.15
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
0.19.9
1.0.0
1.0.0rc1
1.0.0rc2
1.0.0rc3
1.1.0
1.1.1
1.2.0
Fixed in
1.3.0
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-35167
PYSEC-2026-71
GHSA-6326-w46w-ppjw
Apr 06, 2026
8.1
/ 10
High
Network
Low
Low
None
Unchanged
High
High
None
Kedro is a toolbox for production-ready data science. Prior to 1.3.0, the _get_versioned_path() method in kedro/io/core.py constructs filesystem paths by directly interpolating user-supplied version strings without sanitization. Because version strings are used as path components, traversal sequences such as ../ are preserved and can escape the intended versioned dataset directory. This is reachable through multiple entry points: catalog.load(..., version=...), DataCatalog.from_config(..., load_versions=...), and the CLI via kedro run --load-versions=dataset:../../../secrets. An attacker who can influence the version string can force Kedro to load files from outside the intended version directory, enabling unauthorized file reads, data poisoning, or cross-tenant data access in shared environments. This vulnerability is fixed in 1.3.0. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 55 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.10
0.19.11
0.19.12
0.19.13
0.19.14
0.19.15
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
0.19.9
1.0.0
1.0.0rc1
1.0.0rc2
1.0.0rc3
1.1.0
1.1.1
1.2.0
Fixed in
1.3.0
References Updated May 20, 2026 · Source: OSV.dev | ||
0.19.4
patch
4 CVEs
CVE-2024-12215
PYSEC-2026-1485
GHSA-rm69-wvpv-r2w7
Jul 07, 2026
Kedro allows Remote Code Execution by Pulling Micro Packages
8.8
/ 10
High
Network
Low
None
Required
Unchanged
High
High
High
In kedro-org/kedro version 0.19.8, the Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 41 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-9701
PYSEC-2026-367
GHSA-747f-ww56-4q4h
Jun 29, 2026
Kedro deserialization vulnerability
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
A Remote Code Execution (RCE) vulnerability has been identified in the Kedro ShelveStore class (version 0.19.8). This vulnerability allows an attacker to execute arbitrary Python code via deserialization of malicious payloads, potentially leading to a full system compromise. The ShelveStore class uses Python's shelve module to manage session data, which relies on pickle for serialization. Crafting a malicious payload and storing it in the shelve file can lead to RCE when the payload is deserialized. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 41 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
Fixed in
0.19.9
References
Updated Jul 01, 2026 · Source: OSV.dev
CVE-2026-35171
PYSEC-2026-72
GHSA-9cqf-439c-j96r
Apr 06, 2026
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
Kedro is a toolbox for production-ready data science. Prior to 1.3.0, Kedro allows the logging configuration file path to be set via the KEDRO_LOGGING_CONFIG environment variable and loads it without validation. The logging configuration schema supports the special () key, which enables arbitrary callable instantiation. An attacker can exploit this to execute arbitrary system commands during application startup. This is a critical remote code execution (RCE) vulnerability caused by unsafe use of logging.config.dictConfig() with user-controlled input. This vulnerability is fixed in 1.3.0. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 55 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.10
0.19.11
0.19.12
0.19.13
0.19.14
0.19.15
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
0.19.9
1.0.0
1.0.0rc1
1.0.0rc2
1.0.0rc3
1.1.0
1.1.1
1.2.0
Fixed in
1.3.0
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-35167
PYSEC-2026-71
GHSA-6326-w46w-ppjw
Apr 06, 2026
8.1
/ 10
High
Network
Low
Low
None
Unchanged
High
High
None
Kedro is a toolbox for production-ready data science. Prior to 1.3.0, the _get_versioned_path() method in kedro/io/core.py constructs filesystem paths by directly interpolating user-supplied version strings without sanitization. Because version strings are used as path components, traversal sequences such as ../ are preserved and can escape the intended versioned dataset directory. This is reachable through multiple entry points: catalog.load(..., version=...), DataCatalog.from_config(..., load_versions=...), and the CLI via kedro run --load-versions=dataset:../../../secrets. An attacker who can influence the version string can force Kedro to load files from outside the intended version directory, enabling unauthorized file reads, data poisoning, or cross-tenant data access in shared environments. This vulnerability is fixed in 1.3.0. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 55 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.10
0.19.11
0.19.12
0.19.13
0.19.14
0.19.15
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
0.19.9
1.0.0
1.0.0rc1
1.0.0rc2
1.0.0rc3
1.1.0
1.1.1
1.2.0
Fixed in
1.3.0
References Updated May 20, 2026 · Source: OSV.dev | ||
0.19.3
patch
4 CVEs
CVE-2024-12215
PYSEC-2026-1485
GHSA-rm69-wvpv-r2w7
Jul 07, 2026
Kedro allows Remote Code Execution by Pulling Micro Packages
8.8
/ 10
High
Network
Low
None
Required
Unchanged
High
High
High
In kedro-org/kedro version 0.19.8, the Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 41 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-9701
PYSEC-2026-367
GHSA-747f-ww56-4q4h
Jun 29, 2026
Kedro deserialization vulnerability
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
A Remote Code Execution (RCE) vulnerability has been identified in the Kedro ShelveStore class (version 0.19.8). This vulnerability allows an attacker to execute arbitrary Python code via deserialization of malicious payloads, potentially leading to a full system compromise. The ShelveStore class uses Python's shelve module to manage session data, which relies on pickle for serialization. Crafting a malicious payload and storing it in the shelve file can lead to RCE when the payload is deserialized. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 41 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
Fixed in
0.19.9
References
Updated Jul 01, 2026 · Source: OSV.dev
CVE-2026-35171
PYSEC-2026-72
GHSA-9cqf-439c-j96r
Apr 06, 2026
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
Kedro is a toolbox for production-ready data science. Prior to 1.3.0, Kedro allows the logging configuration file path to be set via the KEDRO_LOGGING_CONFIG environment variable and loads it without validation. The logging configuration schema supports the special () key, which enables arbitrary callable instantiation. An attacker can exploit this to execute arbitrary system commands during application startup. This is a critical remote code execution (RCE) vulnerability caused by unsafe use of logging.config.dictConfig() with user-controlled input. This vulnerability is fixed in 1.3.0. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 55 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.10
0.19.11
0.19.12
0.19.13
0.19.14
0.19.15
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
0.19.9
1.0.0
1.0.0rc1
1.0.0rc2
1.0.0rc3
1.1.0
1.1.1
1.2.0
Fixed in
1.3.0
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-35167
PYSEC-2026-71
GHSA-6326-w46w-ppjw
Apr 06, 2026
8.1
/ 10
High
Network
Low
Low
None
Unchanged
High
High
None
Kedro is a toolbox for production-ready data science. Prior to 1.3.0, the _get_versioned_path() method in kedro/io/core.py constructs filesystem paths by directly interpolating user-supplied version strings without sanitization. Because version strings are used as path components, traversal sequences such as ../ are preserved and can escape the intended versioned dataset directory. This is reachable through multiple entry points: catalog.load(..., version=...), DataCatalog.from_config(..., load_versions=...), and the CLI via kedro run --load-versions=dataset:../../../secrets. An attacker who can influence the version string can force Kedro to load files from outside the intended version directory, enabling unauthorized file reads, data poisoning, or cross-tenant data access in shared environments. This vulnerability is fixed in 1.3.0. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 55 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.10
0.19.11
0.19.12
0.19.13
0.19.14
0.19.15
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
0.19.9
1.0.0
1.0.0rc1
1.0.0rc2
1.0.0rc3
1.1.0
1.1.1
1.2.0
Fixed in
1.3.0
References Updated May 20, 2026 · Source: OSV.dev | ||
0.19.2
patch
4 CVEs
CVE-2024-12215
PYSEC-2026-1485
GHSA-rm69-wvpv-r2w7
Jul 07, 2026
Kedro allows Remote Code Execution by Pulling Micro Packages
8.8
/ 10
High
Network
Low
None
Required
Unchanged
High
High
High
In kedro-org/kedro version 0.19.8, the Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 41 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-9701
PYSEC-2026-367
GHSA-747f-ww56-4q4h
Jun 29, 2026
Kedro deserialization vulnerability
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
A Remote Code Execution (RCE) vulnerability has been identified in the Kedro ShelveStore class (version 0.19.8). This vulnerability allows an attacker to execute arbitrary Python code via deserialization of malicious payloads, potentially leading to a full system compromise. The ShelveStore class uses Python's shelve module to manage session data, which relies on pickle for serialization. Crafting a malicious payload and storing it in the shelve file can lead to RCE when the payload is deserialized. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 41 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
Fixed in
0.19.9
References
Updated Jul 01, 2026 · Source: OSV.dev
CVE-2026-35171
PYSEC-2026-72
GHSA-9cqf-439c-j96r
Apr 06, 2026
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
Kedro is a toolbox for production-ready data science. Prior to 1.3.0, Kedro allows the logging configuration file path to be set via the KEDRO_LOGGING_CONFIG environment variable and loads it without validation. The logging configuration schema supports the special () key, which enables arbitrary callable instantiation. An attacker can exploit this to execute arbitrary system commands during application startup. This is a critical remote code execution (RCE) vulnerability caused by unsafe use of logging.config.dictConfig() with user-controlled input. This vulnerability is fixed in 1.3.0. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 55 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.10
0.19.11
0.19.12
0.19.13
0.19.14
0.19.15
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
0.19.9
1.0.0
1.0.0rc1
1.0.0rc2
1.0.0rc3
1.1.0
1.1.1
1.2.0
Fixed in
1.3.0
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-35167
PYSEC-2026-71
GHSA-6326-w46w-ppjw
Apr 06, 2026
8.1
/ 10
High
Network
Low
Low
None
Unchanged
High
High
None
Kedro is a toolbox for production-ready data science. Prior to 1.3.0, the _get_versioned_path() method in kedro/io/core.py constructs filesystem paths by directly interpolating user-supplied version strings without sanitization. Because version strings are used as path components, traversal sequences such as ../ are preserved and can escape the intended versioned dataset directory. This is reachable through multiple entry points: catalog.load(..., version=...), DataCatalog.from_config(..., load_versions=...), and the CLI via kedro run --load-versions=dataset:../../../secrets. An attacker who can influence the version string can force Kedro to load files from outside the intended version directory, enabling unauthorized file reads, data poisoning, or cross-tenant data access in shared environments. This vulnerability is fixed in 1.3.0. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 55 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.10
0.19.11
0.19.12
0.19.13
0.19.14
0.19.15
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
0.19.9
1.0.0
1.0.0rc1
1.0.0rc2
1.0.0rc3
1.1.0
1.1.1
1.2.0
Fixed in
1.3.0
References Updated May 20, 2026 · Source: OSV.dev | ||
0.19.1
patch
4 CVEs
CVE-2024-12215
PYSEC-2026-1485
GHSA-rm69-wvpv-r2w7
Jul 07, 2026
Kedro allows Remote Code Execution by Pulling Micro Packages
8.8
/ 10
High
Network
Low
None
Required
Unchanged
High
High
High
In kedro-org/kedro version 0.19.8, the Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 41 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-9701
PYSEC-2026-367
GHSA-747f-ww56-4q4h
Jun 29, 2026
Kedro deserialization vulnerability
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
A Remote Code Execution (RCE) vulnerability has been identified in the Kedro ShelveStore class (version 0.19.8). This vulnerability allows an attacker to execute arbitrary Python code via deserialization of malicious payloads, potentially leading to a full system compromise. The ShelveStore class uses Python's shelve module to manage session data, which relies on pickle for serialization. Crafting a malicious payload and storing it in the shelve file can lead to RCE when the payload is deserialized. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 41 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
Fixed in
0.19.9
References
Updated Jul 01, 2026 · Source: OSV.dev
CVE-2026-35171
PYSEC-2026-72
GHSA-9cqf-439c-j96r
Apr 06, 2026
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
Kedro is a toolbox for production-ready data science. Prior to 1.3.0, Kedro allows the logging configuration file path to be set via the KEDRO_LOGGING_CONFIG environment variable and loads it without validation. The logging configuration schema supports the special () key, which enables arbitrary callable instantiation. An attacker can exploit this to execute arbitrary system commands during application startup. This is a critical remote code execution (RCE) vulnerability caused by unsafe use of logging.config.dictConfig() with user-controlled input. This vulnerability is fixed in 1.3.0. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 55 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.10
0.19.11
0.19.12
0.19.13
0.19.14
0.19.15
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
0.19.9
1.0.0
1.0.0rc1
1.0.0rc2
1.0.0rc3
1.1.0
1.1.1
1.2.0
Fixed in
1.3.0
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-35167
PYSEC-2026-71
GHSA-6326-w46w-ppjw
Apr 06, 2026
8.1
/ 10
High
Network
Low
Low
None
Unchanged
High
High
None
Kedro is a toolbox for production-ready data science. Prior to 1.3.0, the _get_versioned_path() method in kedro/io/core.py constructs filesystem paths by directly interpolating user-supplied version strings without sanitization. Because version strings are used as path components, traversal sequences such as ../ are preserved and can escape the intended versioned dataset directory. This is reachable through multiple entry points: catalog.load(..., version=...), DataCatalog.from_config(..., load_versions=...), and the CLI via kedro run --load-versions=dataset:../../../secrets. An attacker who can influence the version string can force Kedro to load files from outside the intended version directory, enabling unauthorized file reads, data poisoning, or cross-tenant data access in shared environments. This vulnerability is fixed in 1.3.0. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 55 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.10
0.19.11
0.19.12
0.19.13
0.19.14
0.19.15
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
0.19.9
1.0.0
1.0.0rc1
1.0.0rc2
1.0.0rc3
1.1.0
1.1.1
1.2.0
Fixed in
1.3.0
References Updated May 20, 2026 · Source: OSV.dev | ||
0.19.0
minor
4 CVEs
CVE-2024-12215
PYSEC-2026-1485
GHSA-rm69-wvpv-r2w7
Jul 07, 2026
Kedro allows Remote Code Execution by Pulling Micro Packages
8.8
/ 10
High
Network
Low
None
Required
Unchanged
High
High
High
In kedro-org/kedro version 0.19.8, the Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 41 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-9701
PYSEC-2026-367
GHSA-747f-ww56-4q4h
Jun 29, 2026
Kedro deserialization vulnerability
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
A Remote Code Execution (RCE) vulnerability has been identified in the Kedro ShelveStore class (version 0.19.8). This vulnerability allows an attacker to execute arbitrary Python code via deserialization of malicious payloads, potentially leading to a full system compromise. The ShelveStore class uses Python's shelve module to manage session data, which relies on pickle for serialization. Crafting a malicious payload and storing it in the shelve file can lead to RCE when the payload is deserialized. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 41 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
Fixed in
0.19.9
References
Updated Jul 01, 2026 · Source: OSV.dev
CVE-2026-35171
PYSEC-2026-72
GHSA-9cqf-439c-j96r
Apr 06, 2026
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
Kedro is a toolbox for production-ready data science. Prior to 1.3.0, Kedro allows the logging configuration file path to be set via the KEDRO_LOGGING_CONFIG environment variable and loads it without validation. The logging configuration schema supports the special () key, which enables arbitrary callable instantiation. An attacker can exploit this to execute arbitrary system commands during application startup. This is a critical remote code execution (RCE) vulnerability caused by unsafe use of logging.config.dictConfig() with user-controlled input. This vulnerability is fixed in 1.3.0. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 55 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.10
0.19.11
0.19.12
0.19.13
0.19.14
0.19.15
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
0.19.9
1.0.0
1.0.0rc1
1.0.0rc2
1.0.0rc3
1.1.0
1.1.1
1.2.0
Fixed in
1.3.0
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-35167
PYSEC-2026-71
GHSA-6326-w46w-ppjw
Apr 06, 2026
8.1
/ 10
High
Network
Low
Low
None
Unchanged
High
High
None
Kedro is a toolbox for production-ready data science. Prior to 1.3.0, the _get_versioned_path() method in kedro/io/core.py constructs filesystem paths by directly interpolating user-supplied version strings without sanitization. Because version strings are used as path components, traversal sequences such as ../ are preserved and can escape the intended versioned dataset directory. This is reachable through multiple entry points: catalog.load(..., version=...), DataCatalog.from_config(..., load_versions=...), and the CLI via kedro run --load-versions=dataset:../../../secrets. An attacker who can influence the version string can force Kedro to load files from outside the intended version directory, enabling unauthorized file reads, data poisoning, or cross-tenant data access in shared environments. This vulnerability is fixed in 1.3.0. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 55 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.10
0.19.11
0.19.12
0.19.13
0.19.14
0.19.15
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
0.19.9
1.0.0
1.0.0rc1
1.0.0rc2
1.0.0rc3
1.1.0
1.1.1
1.2.0
Fixed in
1.3.0
References Updated May 20, 2026 · Source: OSV.dev | ||
0.18.14
patch
4 CVEs
CVE-2024-12215
PYSEC-2026-1485
GHSA-rm69-wvpv-r2w7
Jul 07, 2026
Kedro allows Remote Code Execution by Pulling Micro Packages
8.8
/ 10
High
Network
Low
None
Required
Unchanged
High
High
High
In kedro-org/kedro version 0.19.8, the Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 41 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-9701
PYSEC-2026-367
GHSA-747f-ww56-4q4h
Jun 29, 2026
Kedro deserialization vulnerability
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
A Remote Code Execution (RCE) vulnerability has been identified in the Kedro ShelveStore class (version 0.19.8). This vulnerability allows an attacker to execute arbitrary Python code via deserialization of malicious payloads, potentially leading to a full system compromise. The ShelveStore class uses Python's shelve module to manage session data, which relies on pickle for serialization. Crafting a malicious payload and storing it in the shelve file can lead to RCE when the payload is deserialized. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 41 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
Fixed in
0.19.9
References
Updated Jul 01, 2026 · Source: OSV.dev
CVE-2026-35171
PYSEC-2026-72
GHSA-9cqf-439c-j96r
Apr 06, 2026
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
Kedro is a toolbox for production-ready data science. Prior to 1.3.0, Kedro allows the logging configuration file path to be set via the KEDRO_LOGGING_CONFIG environment variable and loads it without validation. The logging configuration schema supports the special () key, which enables arbitrary callable instantiation. An attacker can exploit this to execute arbitrary system commands during application startup. This is a critical remote code execution (RCE) vulnerability caused by unsafe use of logging.config.dictConfig() with user-controlled input. This vulnerability is fixed in 1.3.0. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 55 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.10
0.19.11
0.19.12
0.19.13
0.19.14
0.19.15
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
0.19.9
1.0.0
1.0.0rc1
1.0.0rc2
1.0.0rc3
1.1.0
1.1.1
1.2.0
Fixed in
1.3.0
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-35167
PYSEC-2026-71
GHSA-6326-w46w-ppjw
Apr 06, 2026
8.1
/ 10
High
Network
Low
Low
None
Unchanged
High
High
None
Kedro is a toolbox for production-ready data science. Prior to 1.3.0, the _get_versioned_path() method in kedro/io/core.py constructs filesystem paths by directly interpolating user-supplied version strings without sanitization. Because version strings are used as path components, traversal sequences such as ../ are preserved and can escape the intended versioned dataset directory. This is reachable through multiple entry points: catalog.load(..., version=...), DataCatalog.from_config(..., load_versions=...), and the CLI via kedro run --load-versions=dataset:../../../secrets. An attacker who can influence the version string can force Kedro to load files from outside the intended version directory, enabling unauthorized file reads, data poisoning, or cross-tenant data access in shared environments. This vulnerability is fixed in 1.3.0. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 55 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.10
0.19.11
0.19.12
0.19.13
0.19.14
0.19.15
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
0.19.9
1.0.0
1.0.0rc1
1.0.0rc2
1.0.0rc3
1.1.0
1.1.1
1.2.0
Fixed in
1.3.0
References Updated May 20, 2026 · Source: OSV.dev | ||
0.18.13
patch
4 CVEs
CVE-2024-12215
PYSEC-2026-1485
GHSA-rm69-wvpv-r2w7
Jul 07, 2026
Kedro allows Remote Code Execution by Pulling Micro Packages
8.8
/ 10
High
Network
Low
None
Required
Unchanged
High
High
High
In kedro-org/kedro version 0.19.8, the Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 41 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-9701
PYSEC-2026-367
GHSA-747f-ww56-4q4h
Jun 29, 2026
Kedro deserialization vulnerability
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
A Remote Code Execution (RCE) vulnerability has been identified in the Kedro ShelveStore class (version 0.19.8). This vulnerability allows an attacker to execute arbitrary Python code via deserialization of malicious payloads, potentially leading to a full system compromise. The ShelveStore class uses Python's shelve module to manage session data, which relies on pickle for serialization. Crafting a malicious payload and storing it in the shelve file can lead to RCE when the payload is deserialized. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 41 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
Fixed in
0.19.9
References
Updated Jul 01, 2026 · Source: OSV.dev
CVE-2026-35171
PYSEC-2026-72
GHSA-9cqf-439c-j96r
Apr 06, 2026
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
Kedro is a toolbox for production-ready data science. Prior to 1.3.0, Kedro allows the logging configuration file path to be set via the KEDRO_LOGGING_CONFIG environment variable and loads it without validation. The logging configuration schema supports the special () key, which enables arbitrary callable instantiation. An attacker can exploit this to execute arbitrary system commands during application startup. This is a critical remote code execution (RCE) vulnerability caused by unsafe use of logging.config.dictConfig() with user-controlled input. This vulnerability is fixed in 1.3.0. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 55 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.10
0.19.11
0.19.12
0.19.13
0.19.14
0.19.15
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
0.19.9
1.0.0
1.0.0rc1
1.0.0rc2
1.0.0rc3
1.1.0
1.1.1
1.2.0
Fixed in
1.3.0
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-35167
PYSEC-2026-71
GHSA-6326-w46w-ppjw
Apr 06, 2026
8.1
/ 10
High
Network
Low
Low
None
Unchanged
High
High
None
Kedro is a toolbox for production-ready data science. Prior to 1.3.0, the _get_versioned_path() method in kedro/io/core.py constructs filesystem paths by directly interpolating user-supplied version strings without sanitization. Because version strings are used as path components, traversal sequences such as ../ are preserved and can escape the intended versioned dataset directory. This is reachable through multiple entry points: catalog.load(..., version=...), DataCatalog.from_config(..., load_versions=...), and the CLI via kedro run --load-versions=dataset:../../../secrets. An attacker who can influence the version string can force Kedro to load files from outside the intended version directory, enabling unauthorized file reads, data poisoning, or cross-tenant data access in shared environments. This vulnerability is fixed in 1.3.0. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 55 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.10
0.19.11
0.19.12
0.19.13
0.19.14
0.19.15
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
0.19.9
1.0.0
1.0.0rc1
1.0.0rc2
1.0.0rc3
1.1.0
1.1.1
1.2.0
Fixed in
1.3.0
References Updated May 20, 2026 · Source: OSV.dev | ||
0.18.12
patch
4 CVEs
CVE-2024-12215
PYSEC-2026-1485
GHSA-rm69-wvpv-r2w7
Jul 07, 2026
Kedro allows Remote Code Execution by Pulling Micro Packages
8.8
/ 10
High
Network
Low
None
Required
Unchanged
High
High
High
In kedro-org/kedro version 0.19.8, the Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 41 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-9701
PYSEC-2026-367
GHSA-747f-ww56-4q4h
Jun 29, 2026
Kedro deserialization vulnerability
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
A Remote Code Execution (RCE) vulnerability has been identified in the Kedro ShelveStore class (version 0.19.8). This vulnerability allows an attacker to execute arbitrary Python code via deserialization of malicious payloads, potentially leading to a full system compromise. The ShelveStore class uses Python's shelve module to manage session data, which relies on pickle for serialization. Crafting a malicious payload and storing it in the shelve file can lead to RCE when the payload is deserialized. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 41 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
Fixed in
0.19.9
References
Updated Jul 01, 2026 · Source: OSV.dev
CVE-2026-35171
PYSEC-2026-72
GHSA-9cqf-439c-j96r
Apr 06, 2026
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
Kedro is a toolbox for production-ready data science. Prior to 1.3.0, Kedro allows the logging configuration file path to be set via the KEDRO_LOGGING_CONFIG environment variable and loads it without validation. The logging configuration schema supports the special () key, which enables arbitrary callable instantiation. An attacker can exploit this to execute arbitrary system commands during application startup. This is a critical remote code execution (RCE) vulnerability caused by unsafe use of logging.config.dictConfig() with user-controlled input. This vulnerability is fixed in 1.3.0. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 55 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.10
0.19.11
0.19.12
0.19.13
0.19.14
0.19.15
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
0.19.9
1.0.0
1.0.0rc1
1.0.0rc2
1.0.0rc3
1.1.0
1.1.1
1.2.0
Fixed in
1.3.0
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-35167
PYSEC-2026-71
GHSA-6326-w46w-ppjw
Apr 06, 2026
8.1
/ 10
High
Network
Low
Low
None
Unchanged
High
High
None
Kedro is a toolbox for production-ready data science. Prior to 1.3.0, the _get_versioned_path() method in kedro/io/core.py constructs filesystem paths by directly interpolating user-supplied version strings without sanitization. Because version strings are used as path components, traversal sequences such as ../ are preserved and can escape the intended versioned dataset directory. This is reachable through multiple entry points: catalog.load(..., version=...), DataCatalog.from_config(..., load_versions=...), and the CLI via kedro run --load-versions=dataset:../../../secrets. An attacker who can influence the version string can force Kedro to load files from outside the intended version directory, enabling unauthorized file reads, data poisoning, or cross-tenant data access in shared environments. This vulnerability is fixed in 1.3.0. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 55 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.10
0.19.11
0.19.12
0.19.13
0.19.14
0.19.15
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
0.19.9
1.0.0
1.0.0rc1
1.0.0rc2
1.0.0rc3
1.1.0
1.1.1
1.2.0
Fixed in
1.3.0
References Updated May 20, 2026 · Source: OSV.dev | ||
0.18.11
patch
4 CVEs
CVE-2024-12215
PYSEC-2026-1485
GHSA-rm69-wvpv-r2w7
Jul 07, 2026
Kedro allows Remote Code Execution by Pulling Micro Packages
8.8
/ 10
High
Network
Low
None
Required
Unchanged
High
High
High
In kedro-org/kedro version 0.19.8, the Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 41 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-9701
PYSEC-2026-367
GHSA-747f-ww56-4q4h
Jun 29, 2026
Kedro deserialization vulnerability
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
A Remote Code Execution (RCE) vulnerability has been identified in the Kedro ShelveStore class (version 0.19.8). This vulnerability allows an attacker to execute arbitrary Python code via deserialization of malicious payloads, potentially leading to a full system compromise. The ShelveStore class uses Python's shelve module to manage session data, which relies on pickle for serialization. Crafting a malicious payload and storing it in the shelve file can lead to RCE when the payload is deserialized. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 41 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
Fixed in
0.19.9
References
Updated Jul 01, 2026 · Source: OSV.dev
CVE-2026-35171
PYSEC-2026-72
GHSA-9cqf-439c-j96r
Apr 06, 2026
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
Kedro is a toolbox for production-ready data science. Prior to 1.3.0, Kedro allows the logging configuration file path to be set via the KEDRO_LOGGING_CONFIG environment variable and loads it without validation. The logging configuration schema supports the special () key, which enables arbitrary callable instantiation. An attacker can exploit this to execute arbitrary system commands during application startup. This is a critical remote code execution (RCE) vulnerability caused by unsafe use of logging.config.dictConfig() with user-controlled input. This vulnerability is fixed in 1.3.0. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 55 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.10
0.19.11
0.19.12
0.19.13
0.19.14
0.19.15
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
0.19.9
1.0.0
1.0.0rc1
1.0.0rc2
1.0.0rc3
1.1.0
1.1.1
1.2.0
Fixed in
1.3.0
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-35167
PYSEC-2026-71
GHSA-6326-w46w-ppjw
Apr 06, 2026
8.1
/ 10
High
Network
Low
Low
None
Unchanged
High
High
None
Kedro is a toolbox for production-ready data science. Prior to 1.3.0, the _get_versioned_path() method in kedro/io/core.py constructs filesystem paths by directly interpolating user-supplied version strings without sanitization. Because version strings are used as path components, traversal sequences such as ../ are preserved and can escape the intended versioned dataset directory. This is reachable through multiple entry points: catalog.load(..., version=...), DataCatalog.from_config(..., load_versions=...), and the CLI via kedro run --load-versions=dataset:../../../secrets. An attacker who can influence the version string can force Kedro to load files from outside the intended version directory, enabling unauthorized file reads, data poisoning, or cross-tenant data access in shared environments. This vulnerability is fixed in 1.3.0. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 55 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.10
0.19.11
0.19.12
0.19.13
0.19.14
0.19.15
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
0.19.9
1.0.0
1.0.0rc1
1.0.0rc2
1.0.0rc3
1.1.0
1.1.1
1.2.0
Fixed in
1.3.0
References Updated May 20, 2026 · Source: OSV.dev | ||
0.18.10
patch
4 CVEs
CVE-2024-12215
PYSEC-2026-1485
GHSA-rm69-wvpv-r2w7
Jul 07, 2026
Kedro allows Remote Code Execution by Pulling Micro Packages
8.8
/ 10
High
Network
Low
None
Required
Unchanged
High
High
High
In kedro-org/kedro version 0.19.8, the Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 41 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-9701
PYSEC-2026-367
GHSA-747f-ww56-4q4h
Jun 29, 2026
Kedro deserialization vulnerability
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
A Remote Code Execution (RCE) vulnerability has been identified in the Kedro ShelveStore class (version 0.19.8). This vulnerability allows an attacker to execute arbitrary Python code via deserialization of malicious payloads, potentially leading to a full system compromise. The ShelveStore class uses Python's shelve module to manage session data, which relies on pickle for serialization. Crafting a malicious payload and storing it in the shelve file can lead to RCE when the payload is deserialized. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 41 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
Fixed in
0.19.9
References
Updated Jul 01, 2026 · Source: OSV.dev
CVE-2026-35171
PYSEC-2026-72
GHSA-9cqf-439c-j96r
Apr 06, 2026
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
Kedro is a toolbox for production-ready data science. Prior to 1.3.0, Kedro allows the logging configuration file path to be set via the KEDRO_LOGGING_CONFIG environment variable and loads it without validation. The logging configuration schema supports the special () key, which enables arbitrary callable instantiation. An attacker can exploit this to execute arbitrary system commands during application startup. This is a critical remote code execution (RCE) vulnerability caused by unsafe use of logging.config.dictConfig() with user-controlled input. This vulnerability is fixed in 1.3.0. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 55 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.10
0.19.11
0.19.12
0.19.13
0.19.14
0.19.15
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
0.19.9
1.0.0
1.0.0rc1
1.0.0rc2
1.0.0rc3
1.1.0
1.1.1
1.2.0
Fixed in
1.3.0
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-35167
PYSEC-2026-71
GHSA-6326-w46w-ppjw
Apr 06, 2026
8.1
/ 10
High
Network
Low
Low
None
Unchanged
High
High
None
Kedro is a toolbox for production-ready data science. Prior to 1.3.0, the _get_versioned_path() method in kedro/io/core.py constructs filesystem paths by directly interpolating user-supplied version strings without sanitization. Because version strings are used as path components, traversal sequences such as ../ are preserved and can escape the intended versioned dataset directory. This is reachable through multiple entry points: catalog.load(..., version=...), DataCatalog.from_config(..., load_versions=...), and the CLI via kedro run --load-versions=dataset:../../../secrets. An attacker who can influence the version string can force Kedro to load files from outside the intended version directory, enabling unauthorized file reads, data poisoning, or cross-tenant data access in shared environments. This vulnerability is fixed in 1.3.0. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 55 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.10
0.19.11
0.19.12
0.19.13
0.19.14
0.19.15
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
0.19.9
1.0.0
1.0.0rc1
1.0.0rc2
1.0.0rc3
1.1.0
1.1.1
1.2.0
Fixed in
1.3.0
References Updated May 20, 2026 · Source: OSV.dev | ||
0.18.9
patch
4 CVEs
CVE-2024-12215
PYSEC-2026-1485
GHSA-rm69-wvpv-r2w7
Jul 07, 2026
Kedro allows Remote Code Execution by Pulling Micro Packages
8.8
/ 10
High
Network
Low
None
Required
Unchanged
High
High
High
In kedro-org/kedro version 0.19.8, the Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 41 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-9701
PYSEC-2026-367
GHSA-747f-ww56-4q4h
Jun 29, 2026
Kedro deserialization vulnerability
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
A Remote Code Execution (RCE) vulnerability has been identified in the Kedro ShelveStore class (version 0.19.8). This vulnerability allows an attacker to execute arbitrary Python code via deserialization of malicious payloads, potentially leading to a full system compromise. The ShelveStore class uses Python's shelve module to manage session data, which relies on pickle for serialization. Crafting a malicious payload and storing it in the shelve file can lead to RCE when the payload is deserialized. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 41 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
Fixed in
0.19.9
References
Updated Jul 01, 2026 · Source: OSV.dev
CVE-2026-35171
PYSEC-2026-72
GHSA-9cqf-439c-j96r
Apr 06, 2026
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
Kedro is a toolbox for production-ready data science. Prior to 1.3.0, Kedro allows the logging configuration file path to be set via the KEDRO_LOGGING_CONFIG environment variable and loads it without validation. The logging configuration schema supports the special () key, which enables arbitrary callable instantiation. An attacker can exploit this to execute arbitrary system commands during application startup. This is a critical remote code execution (RCE) vulnerability caused by unsafe use of logging.config.dictConfig() with user-controlled input. This vulnerability is fixed in 1.3.0. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 55 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.10
0.19.11
0.19.12
0.19.13
0.19.14
0.19.15
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
0.19.9
1.0.0
1.0.0rc1
1.0.0rc2
1.0.0rc3
1.1.0
1.1.1
1.2.0
Fixed in
1.3.0
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-35167
PYSEC-2026-71
GHSA-6326-w46w-ppjw
Apr 06, 2026
8.1
/ 10
High
Network
Low
Low
None
Unchanged
High
High
None
Kedro is a toolbox for production-ready data science. Prior to 1.3.0, the _get_versioned_path() method in kedro/io/core.py constructs filesystem paths by directly interpolating user-supplied version strings without sanitization. Because version strings are used as path components, traversal sequences such as ../ are preserved and can escape the intended versioned dataset directory. This is reachable through multiple entry points: catalog.load(..., version=...), DataCatalog.from_config(..., load_versions=...), and the CLI via kedro run --load-versions=dataset:../../../secrets. An attacker who can influence the version string can force Kedro to load files from outside the intended version directory, enabling unauthorized file reads, data poisoning, or cross-tenant data access in shared environments. This vulnerability is fixed in 1.3.0. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 55 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.10
0.19.11
0.19.12
0.19.13
0.19.14
0.19.15
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
0.19.9
1.0.0
1.0.0rc1
1.0.0rc2
1.0.0rc3
1.1.0
1.1.1
1.2.0
Fixed in
1.3.0
References Updated May 20, 2026 · Source: OSV.dev | ||
0.18.8
patch
4 CVEs
CVE-2024-12215
PYSEC-2026-1485
GHSA-rm69-wvpv-r2w7
Jul 07, 2026
Kedro allows Remote Code Execution by Pulling Micro Packages
8.8
/ 10
High
Network
Low
None
Required
Unchanged
High
High
High
In kedro-org/kedro version 0.19.8, the Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 41 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-9701
PYSEC-2026-367
GHSA-747f-ww56-4q4h
Jun 29, 2026
Kedro deserialization vulnerability
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
A Remote Code Execution (RCE) vulnerability has been identified in the Kedro ShelveStore class (version 0.19.8). This vulnerability allows an attacker to execute arbitrary Python code via deserialization of malicious payloads, potentially leading to a full system compromise. The ShelveStore class uses Python's shelve module to manage session data, which relies on pickle for serialization. Crafting a malicious payload and storing it in the shelve file can lead to RCE when the payload is deserialized. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 41 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
Fixed in
0.19.9
References
Updated Jul 01, 2026 · Source: OSV.dev
CVE-2026-35171
PYSEC-2026-72
GHSA-9cqf-439c-j96r
Apr 06, 2026
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
Kedro is a toolbox for production-ready data science. Prior to 1.3.0, Kedro allows the logging configuration file path to be set via the KEDRO_LOGGING_CONFIG environment variable and loads it without validation. The logging configuration schema supports the special () key, which enables arbitrary callable instantiation. An attacker can exploit this to execute arbitrary system commands during application startup. This is a critical remote code execution (RCE) vulnerability caused by unsafe use of logging.config.dictConfig() with user-controlled input. This vulnerability is fixed in 1.3.0. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 55 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.10
0.19.11
0.19.12
0.19.13
0.19.14
0.19.15
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
0.19.9
1.0.0
1.0.0rc1
1.0.0rc2
1.0.0rc3
1.1.0
1.1.1
1.2.0
Fixed in
1.3.0
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-35167
PYSEC-2026-71
GHSA-6326-w46w-ppjw
Apr 06, 2026
8.1
/ 10
High
Network
Low
Low
None
Unchanged
High
High
None
Kedro is a toolbox for production-ready data science. Prior to 1.3.0, the _get_versioned_path() method in kedro/io/core.py constructs filesystem paths by directly interpolating user-supplied version strings without sanitization. Because version strings are used as path components, traversal sequences such as ../ are preserved and can escape the intended versioned dataset directory. This is reachable through multiple entry points: catalog.load(..., version=...), DataCatalog.from_config(..., load_versions=...), and the CLI via kedro run --load-versions=dataset:../../../secrets. An attacker who can influence the version string can force Kedro to load files from outside the intended version directory, enabling unauthorized file reads, data poisoning, or cross-tenant data access in shared environments. This vulnerability is fixed in 1.3.0. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 55 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.10
0.19.11
0.19.12
0.19.13
0.19.14
0.19.15
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
0.19.9
1.0.0
1.0.0rc1
1.0.0rc2
1.0.0rc3
1.1.0
1.1.1
1.2.0
Fixed in
1.3.0
References Updated May 20, 2026 · Source: OSV.dev | ||
0.18.7
patch
4 CVEs
CVE-2024-12215
PYSEC-2026-1485
GHSA-rm69-wvpv-r2w7
Jul 07, 2026
Kedro allows Remote Code Execution by Pulling Micro Packages
8.8
/ 10
High
Network
Low
None
Required
Unchanged
High
High
High
In kedro-org/kedro version 0.19.8, the Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 41 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-9701
PYSEC-2026-367
GHSA-747f-ww56-4q4h
Jun 29, 2026
Kedro deserialization vulnerability
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
A Remote Code Execution (RCE) vulnerability has been identified in the Kedro ShelveStore class (version 0.19.8). This vulnerability allows an attacker to execute arbitrary Python code via deserialization of malicious payloads, potentially leading to a full system compromise. The ShelveStore class uses Python's shelve module to manage session data, which relies on pickle for serialization. Crafting a malicious payload and storing it in the shelve file can lead to RCE when the payload is deserialized. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 41 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
Fixed in
0.19.9
References
Updated Jul 01, 2026 · Source: OSV.dev
CVE-2026-35171
PYSEC-2026-72
GHSA-9cqf-439c-j96r
Apr 06, 2026
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
Kedro is a toolbox for production-ready data science. Prior to 1.3.0, Kedro allows the logging configuration file path to be set via the KEDRO_LOGGING_CONFIG environment variable and loads it without validation. The logging configuration schema supports the special () key, which enables arbitrary callable instantiation. An attacker can exploit this to execute arbitrary system commands during application startup. This is a critical remote code execution (RCE) vulnerability caused by unsafe use of logging.config.dictConfig() with user-controlled input. This vulnerability is fixed in 1.3.0. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 55 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.10
0.19.11
0.19.12
0.19.13
0.19.14
0.19.15
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
0.19.9
1.0.0
1.0.0rc1
1.0.0rc2
1.0.0rc3
1.1.0
1.1.1
1.2.0
Fixed in
1.3.0
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-35167
PYSEC-2026-71
GHSA-6326-w46w-ppjw
Apr 06, 2026
8.1
/ 10
High
Network
Low
Low
None
Unchanged
High
High
None
Kedro is a toolbox for production-ready data science. Prior to 1.3.0, the _get_versioned_path() method in kedro/io/core.py constructs filesystem paths by directly interpolating user-supplied version strings without sanitization. Because version strings are used as path components, traversal sequences such as ../ are preserved and can escape the intended versioned dataset directory. This is reachable through multiple entry points: catalog.load(..., version=...), DataCatalog.from_config(..., load_versions=...), and the CLI via kedro run --load-versions=dataset:../../../secrets. An attacker who can influence the version string can force Kedro to load files from outside the intended version directory, enabling unauthorized file reads, data poisoning, or cross-tenant data access in shared environments. This vulnerability is fixed in 1.3.0. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 55 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.10
0.19.11
0.19.12
0.19.13
0.19.14
0.19.15
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
0.19.9
1.0.0
1.0.0rc1
1.0.0rc2
1.0.0rc3
1.1.0
1.1.1
1.2.0
Fixed in
1.3.0
References Updated May 20, 2026 · Source: OSV.dev | ||
0.18.6
patch
4 CVEs
CVE-2024-12215
PYSEC-2026-1485
GHSA-rm69-wvpv-r2w7
Jul 07, 2026
Kedro allows Remote Code Execution by Pulling Micro Packages
8.8
/ 10
High
Network
Low
None
Required
Unchanged
High
High
High
In kedro-org/kedro version 0.19.8, the Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 41 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-9701
PYSEC-2026-367
GHSA-747f-ww56-4q4h
Jun 29, 2026
Kedro deserialization vulnerability
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
A Remote Code Execution (RCE) vulnerability has been identified in the Kedro ShelveStore class (version 0.19.8). This vulnerability allows an attacker to execute arbitrary Python code via deserialization of malicious payloads, potentially leading to a full system compromise. The ShelveStore class uses Python's shelve module to manage session data, which relies on pickle for serialization. Crafting a malicious payload and storing it in the shelve file can lead to RCE when the payload is deserialized. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 41 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
Fixed in
0.19.9
References
Updated Jul 01, 2026 · Source: OSV.dev
CVE-2026-35171
PYSEC-2026-72
GHSA-9cqf-439c-j96r
Apr 06, 2026
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
Kedro is a toolbox for production-ready data science. Prior to 1.3.0, Kedro allows the logging configuration file path to be set via the KEDRO_LOGGING_CONFIG environment variable and loads it without validation. The logging configuration schema supports the special () key, which enables arbitrary callable instantiation. An attacker can exploit this to execute arbitrary system commands during application startup. This is a critical remote code execution (RCE) vulnerability caused by unsafe use of logging.config.dictConfig() with user-controlled input. This vulnerability is fixed in 1.3.0. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 55 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.10
0.19.11
0.19.12
0.19.13
0.19.14
0.19.15
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
0.19.9
1.0.0
1.0.0rc1
1.0.0rc2
1.0.0rc3
1.1.0
1.1.1
1.2.0
Fixed in
1.3.0
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-35167
PYSEC-2026-71
GHSA-6326-w46w-ppjw
Apr 06, 2026
8.1
/ 10
High
Network
Low
Low
None
Unchanged
High
High
None
Kedro is a toolbox for production-ready data science. Prior to 1.3.0, the _get_versioned_path() method in kedro/io/core.py constructs filesystem paths by directly interpolating user-supplied version strings without sanitization. Because version strings are used as path components, traversal sequences such as ../ are preserved and can escape the intended versioned dataset directory. This is reachable through multiple entry points: catalog.load(..., version=...), DataCatalog.from_config(..., load_versions=...), and the CLI via kedro run --load-versions=dataset:../../../secrets. An attacker who can influence the version string can force Kedro to load files from outside the intended version directory, enabling unauthorized file reads, data poisoning, or cross-tenant data access in shared environments. This vulnerability is fixed in 1.3.0. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 55 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.10
0.19.11
0.19.12
0.19.13
0.19.14
0.19.15
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
0.19.9
1.0.0
1.0.0rc1
1.0.0rc2
1.0.0rc3
1.1.0
1.1.1
1.2.0
Fixed in
1.3.0
References Updated May 20, 2026 · Source: OSV.dev | ||
0.18.5
patch
4 CVEs
CVE-2024-12215
PYSEC-2026-1485
GHSA-rm69-wvpv-r2w7
Jul 07, 2026
Kedro allows Remote Code Execution by Pulling Micro Packages
8.8
/ 10
High
Network
Low
None
Required
Unchanged
High
High
High
In kedro-org/kedro version 0.19.8, the Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 41 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-9701
PYSEC-2026-367
GHSA-747f-ww56-4q4h
Jun 29, 2026
Kedro deserialization vulnerability
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
A Remote Code Execution (RCE) vulnerability has been identified in the Kedro ShelveStore class (version 0.19.8). This vulnerability allows an attacker to execute arbitrary Python code via deserialization of malicious payloads, potentially leading to a full system compromise. The ShelveStore class uses Python's shelve module to manage session data, which relies on pickle for serialization. Crafting a malicious payload and storing it in the shelve file can lead to RCE when the payload is deserialized. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 41 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
Fixed in
0.19.9
References
Updated Jul 01, 2026 · Source: OSV.dev
CVE-2026-35171
PYSEC-2026-72
GHSA-9cqf-439c-j96r
Apr 06, 2026
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
Kedro is a toolbox for production-ready data science. Prior to 1.3.0, Kedro allows the logging configuration file path to be set via the KEDRO_LOGGING_CONFIG environment variable and loads it without validation. The logging configuration schema supports the special () key, which enables arbitrary callable instantiation. An attacker can exploit this to execute arbitrary system commands during application startup. This is a critical remote code execution (RCE) vulnerability caused by unsafe use of logging.config.dictConfig() with user-controlled input. This vulnerability is fixed in 1.3.0. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 55 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.10
0.19.11
0.19.12
0.19.13
0.19.14
0.19.15
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
0.19.9
1.0.0
1.0.0rc1
1.0.0rc2
1.0.0rc3
1.1.0
1.1.1
1.2.0
Fixed in
1.3.0
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-35167
PYSEC-2026-71
GHSA-6326-w46w-ppjw
Apr 06, 2026
8.1
/ 10
High
Network
Low
Low
None
Unchanged
High
High
None
Kedro is a toolbox for production-ready data science. Prior to 1.3.0, the _get_versioned_path() method in kedro/io/core.py constructs filesystem paths by directly interpolating user-supplied version strings without sanitization. Because version strings are used as path components, traversal sequences such as ../ are preserved and can escape the intended versioned dataset directory. This is reachable through multiple entry points: catalog.load(..., version=...), DataCatalog.from_config(..., load_versions=...), and the CLI via kedro run --load-versions=dataset:../../../secrets. An attacker who can influence the version string can force Kedro to load files from outside the intended version directory, enabling unauthorized file reads, data poisoning, or cross-tenant data access in shared environments. This vulnerability is fixed in 1.3.0. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 55 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.10
0.19.11
0.19.12
0.19.13
0.19.14
0.19.15
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
0.19.9
1.0.0
1.0.0rc1
1.0.0rc2
1.0.0rc3
1.1.0
1.1.1
1.2.0
Fixed in
1.3.0
References Updated May 20, 2026 · Source: OSV.dev | ||
0.18.4
patch
4 CVEs
CVE-2024-12215
PYSEC-2026-1485
GHSA-rm69-wvpv-r2w7
Jul 07, 2026
Kedro allows Remote Code Execution by Pulling Micro Packages
8.8
/ 10
High
Network
Low
None
Required
Unchanged
High
High
High
In kedro-org/kedro version 0.19.8, the Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 41 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-9701
PYSEC-2026-367
GHSA-747f-ww56-4q4h
Jun 29, 2026
Kedro deserialization vulnerability
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
A Remote Code Execution (RCE) vulnerability has been identified in the Kedro ShelveStore class (version 0.19.8). This vulnerability allows an attacker to execute arbitrary Python code via deserialization of malicious payloads, potentially leading to a full system compromise. The ShelveStore class uses Python's shelve module to manage session data, which relies on pickle for serialization. Crafting a malicious payload and storing it in the shelve file can lead to RCE when the payload is deserialized. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 41 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
Fixed in
0.19.9
References
Updated Jul 01, 2026 · Source: OSV.dev
CVE-2026-35171
PYSEC-2026-72
GHSA-9cqf-439c-j96r
Apr 06, 2026
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
Kedro is a toolbox for production-ready data science. Prior to 1.3.0, Kedro allows the logging configuration file path to be set via the KEDRO_LOGGING_CONFIG environment variable and loads it without validation. The logging configuration schema supports the special () key, which enables arbitrary callable instantiation. An attacker can exploit this to execute arbitrary system commands during application startup. This is a critical remote code execution (RCE) vulnerability caused by unsafe use of logging.config.dictConfig() with user-controlled input. This vulnerability is fixed in 1.3.0. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 55 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.10
0.19.11
0.19.12
0.19.13
0.19.14
0.19.15
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
0.19.9
1.0.0
1.0.0rc1
1.0.0rc2
1.0.0rc3
1.1.0
1.1.1
1.2.0
Fixed in
1.3.0
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-35167
PYSEC-2026-71
GHSA-6326-w46w-ppjw
Apr 06, 2026
8.1
/ 10
High
Network
Low
Low
None
Unchanged
High
High
None
Kedro is a toolbox for production-ready data science. Prior to 1.3.0, the _get_versioned_path() method in kedro/io/core.py constructs filesystem paths by directly interpolating user-supplied version strings without sanitization. Because version strings are used as path components, traversal sequences such as ../ are preserved and can escape the intended versioned dataset directory. This is reachable through multiple entry points: catalog.load(..., version=...), DataCatalog.from_config(..., load_versions=...), and the CLI via kedro run --load-versions=dataset:../../../secrets. An attacker who can influence the version string can force Kedro to load files from outside the intended version directory, enabling unauthorized file reads, data poisoning, or cross-tenant data access in shared environments. This vulnerability is fixed in 1.3.0. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 55 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.10
0.19.11
0.19.12
0.19.13
0.19.14
0.19.15
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
0.19.9
1.0.0
1.0.0rc1
1.0.0rc2
1.0.0rc3
1.1.0
1.1.1
1.2.0
Fixed in
1.3.0
References Updated May 20, 2026 · Source: OSV.dev | ||
0.18.3
patch
4 CVEs
CVE-2024-12215
PYSEC-2026-1485
GHSA-rm69-wvpv-r2w7
Jul 07, 2026
Kedro allows Remote Code Execution by Pulling Micro Packages
8.8
/ 10
High
Network
Low
None
Required
Unchanged
High
High
High
In kedro-org/kedro version 0.19.8, the Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 41 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-9701
PYSEC-2026-367
GHSA-747f-ww56-4q4h
Jun 29, 2026
Kedro deserialization vulnerability
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
A Remote Code Execution (RCE) vulnerability has been identified in the Kedro ShelveStore class (version 0.19.8). This vulnerability allows an attacker to execute arbitrary Python code via deserialization of malicious payloads, potentially leading to a full system compromise. The ShelveStore class uses Python's shelve module to manage session data, which relies on pickle for serialization. Crafting a malicious payload and storing it in the shelve file can lead to RCE when the payload is deserialized. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 41 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
Fixed in
0.19.9
References
Updated Jul 01, 2026 · Source: OSV.dev
CVE-2026-35171
PYSEC-2026-72
GHSA-9cqf-439c-j96r
Apr 06, 2026
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
Kedro is a toolbox for production-ready data science. Prior to 1.3.0, Kedro allows the logging configuration file path to be set via the KEDRO_LOGGING_CONFIG environment variable and loads it without validation. The logging configuration schema supports the special () key, which enables arbitrary callable instantiation. An attacker can exploit this to execute arbitrary system commands during application startup. This is a critical remote code execution (RCE) vulnerability caused by unsafe use of logging.config.dictConfig() with user-controlled input. This vulnerability is fixed in 1.3.0. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 55 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.10
0.19.11
0.19.12
0.19.13
0.19.14
0.19.15
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
0.19.9
1.0.0
1.0.0rc1
1.0.0rc2
1.0.0rc3
1.1.0
1.1.1
1.2.0
Fixed in
1.3.0
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-35167
PYSEC-2026-71
GHSA-6326-w46w-ppjw
Apr 06, 2026
8.1
/ 10
High
Network
Low
Low
None
Unchanged
High
High
None
Kedro is a toolbox for production-ready data science. Prior to 1.3.0, the _get_versioned_path() method in kedro/io/core.py constructs filesystem paths by directly interpolating user-supplied version strings without sanitization. Because version strings are used as path components, traversal sequences such as ../ are preserved and can escape the intended versioned dataset directory. This is reachable through multiple entry points: catalog.load(..., version=...), DataCatalog.from_config(..., load_versions=...), and the CLI via kedro run --load-versions=dataset:../../../secrets. An attacker who can influence the version string can force Kedro to load files from outside the intended version directory, enabling unauthorized file reads, data poisoning, or cross-tenant data access in shared environments. This vulnerability is fixed in 1.3.0. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 55 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.10
0.19.11
0.19.12
0.19.13
0.19.14
0.19.15
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
0.19.9
1.0.0
1.0.0rc1
1.0.0rc2
1.0.0rc3
1.1.0
1.1.1
1.2.0
Fixed in
1.3.0
References Updated May 20, 2026 · Source: OSV.dev | ||
0.18.2
patch
4 CVEs
CVE-2024-12215
PYSEC-2026-1485
GHSA-rm69-wvpv-r2w7
Jul 07, 2026
Kedro allows Remote Code Execution by Pulling Micro Packages
8.8
/ 10
High
Network
Low
None
Required
Unchanged
High
High
High
In kedro-org/kedro version 0.19.8, the Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 41 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-9701
PYSEC-2026-367
GHSA-747f-ww56-4q4h
Jun 29, 2026
Kedro deserialization vulnerability
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
A Remote Code Execution (RCE) vulnerability has been identified in the Kedro ShelveStore class (version 0.19.8). This vulnerability allows an attacker to execute arbitrary Python code via deserialization of malicious payloads, potentially leading to a full system compromise. The ShelveStore class uses Python's shelve module to manage session data, which relies on pickle for serialization. Crafting a malicious payload and storing it in the shelve file can lead to RCE when the payload is deserialized. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 41 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
Fixed in
0.19.9
References
Updated Jul 01, 2026 · Source: OSV.dev
CVE-2026-35171
PYSEC-2026-72
GHSA-9cqf-439c-j96r
Apr 06, 2026
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
Kedro is a toolbox for production-ready data science. Prior to 1.3.0, Kedro allows the logging configuration file path to be set via the KEDRO_LOGGING_CONFIG environment variable and loads it without validation. The logging configuration schema supports the special () key, which enables arbitrary callable instantiation. An attacker can exploit this to execute arbitrary system commands during application startup. This is a critical remote code execution (RCE) vulnerability caused by unsafe use of logging.config.dictConfig() with user-controlled input. This vulnerability is fixed in 1.3.0. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 55 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.10
0.19.11
0.19.12
0.19.13
0.19.14
0.19.15
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
0.19.9
1.0.0
1.0.0rc1
1.0.0rc2
1.0.0rc3
1.1.0
1.1.1
1.2.0
Fixed in
1.3.0
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-35167
PYSEC-2026-71
GHSA-6326-w46w-ppjw
Apr 06, 2026
8.1
/ 10
High
Network
Low
Low
None
Unchanged
High
High
None
Kedro is a toolbox for production-ready data science. Prior to 1.3.0, the _get_versioned_path() method in kedro/io/core.py constructs filesystem paths by directly interpolating user-supplied version strings without sanitization. Because version strings are used as path components, traversal sequences such as ../ are preserved and can escape the intended versioned dataset directory. This is reachable through multiple entry points: catalog.load(..., version=...), DataCatalog.from_config(..., load_versions=...), and the CLI via kedro run --load-versions=dataset:../../../secrets. An attacker who can influence the version string can force Kedro to load files from outside the intended version directory, enabling unauthorized file reads, data poisoning, or cross-tenant data access in shared environments. This vulnerability is fixed in 1.3.0. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 55 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.10
0.19.11
0.19.12
0.19.13
0.19.14
0.19.15
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
0.19.9
1.0.0
1.0.0rc1
1.0.0rc2
1.0.0rc3
1.1.0
1.1.1
1.2.0
Fixed in
1.3.0
References Updated May 20, 2026 · Source: OSV.dev | ||
0.18.1
patch
4 CVEs
CVE-2024-12215
PYSEC-2026-1485
GHSA-rm69-wvpv-r2w7
Jul 07, 2026
Kedro allows Remote Code Execution by Pulling Micro Packages
8.8
/ 10
High
Network
Low
None
Required
Unchanged
High
High
High
In kedro-org/kedro version 0.19.8, the Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 41 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-9701
PYSEC-2026-367
GHSA-747f-ww56-4q4h
Jun 29, 2026
Kedro deserialization vulnerability
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
A Remote Code Execution (RCE) vulnerability has been identified in the Kedro ShelveStore class (version 0.19.8). This vulnerability allows an attacker to execute arbitrary Python code via deserialization of malicious payloads, potentially leading to a full system compromise. The ShelveStore class uses Python's shelve module to manage session data, which relies on pickle for serialization. Crafting a malicious payload and storing it in the shelve file can lead to RCE when the payload is deserialized. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 41 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
Fixed in
0.19.9
References
Updated Jul 01, 2026 · Source: OSV.dev
CVE-2026-35171
PYSEC-2026-72
GHSA-9cqf-439c-j96r
Apr 06, 2026
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
Kedro is a toolbox for production-ready data science. Prior to 1.3.0, Kedro allows the logging configuration file path to be set via the KEDRO_LOGGING_CONFIG environment variable and loads it without validation. The logging configuration schema supports the special () key, which enables arbitrary callable instantiation. An attacker can exploit this to execute arbitrary system commands during application startup. This is a critical remote code execution (RCE) vulnerability caused by unsafe use of logging.config.dictConfig() with user-controlled input. This vulnerability is fixed in 1.3.0. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 55 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.10
0.19.11
0.19.12
0.19.13
0.19.14
0.19.15
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
0.19.9
1.0.0
1.0.0rc1
1.0.0rc2
1.0.0rc3
1.1.0
1.1.1
1.2.0
Fixed in
1.3.0
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-35167
PYSEC-2026-71
GHSA-6326-w46w-ppjw
Apr 06, 2026
8.1
/ 10
High
Network
Low
Low
None
Unchanged
High
High
None
Kedro is a toolbox for production-ready data science. Prior to 1.3.0, the _get_versioned_path() method in kedro/io/core.py constructs filesystem paths by directly interpolating user-supplied version strings without sanitization. Because version strings are used as path components, traversal sequences such as ../ are preserved and can escape the intended versioned dataset directory. This is reachable through multiple entry points: catalog.load(..., version=...), DataCatalog.from_config(..., load_versions=...), and the CLI via kedro run --load-versions=dataset:../../../secrets. An attacker who can influence the version string can force Kedro to load files from outside the intended version directory, enabling unauthorized file reads, data poisoning, or cross-tenant data access in shared environments. This vulnerability is fixed in 1.3.0. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 55 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.10
0.19.11
0.19.12
0.19.13
0.19.14
0.19.15
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
0.19.9
1.0.0
1.0.0rc1
1.0.0rc2
1.0.0rc3
1.1.0
1.1.1
1.2.0
Fixed in
1.3.0
References Updated May 20, 2026 · Source: OSV.dev | ||
0.18.0
minor
4 CVEs
CVE-2024-12215
PYSEC-2026-1485
GHSA-rm69-wvpv-r2w7
Jul 07, 2026
Kedro allows Remote Code Execution by Pulling Micro Packages
8.8
/ 10
High
Network
Low
None
Required
Unchanged
High
High
High
In kedro-org/kedro version 0.19.8, the Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 41 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-9701
PYSEC-2026-367
GHSA-747f-ww56-4q4h
Jun 29, 2026
Kedro deserialization vulnerability
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
A Remote Code Execution (RCE) vulnerability has been identified in the Kedro ShelveStore class (version 0.19.8). This vulnerability allows an attacker to execute arbitrary Python code via deserialization of malicious payloads, potentially leading to a full system compromise. The ShelveStore class uses Python's shelve module to manage session data, which relies on pickle for serialization. Crafting a malicious payload and storing it in the shelve file can lead to RCE when the payload is deserialized. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 41 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
Fixed in
0.19.9
References
Updated Jul 01, 2026 · Source: OSV.dev
CVE-2026-35171
PYSEC-2026-72
GHSA-9cqf-439c-j96r
Apr 06, 2026
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
Kedro is a toolbox for production-ready data science. Prior to 1.3.0, Kedro allows the logging configuration file path to be set via the KEDRO_LOGGING_CONFIG environment variable and loads it without validation. The logging configuration schema supports the special () key, which enables arbitrary callable instantiation. An attacker can exploit this to execute arbitrary system commands during application startup. This is a critical remote code execution (RCE) vulnerability caused by unsafe use of logging.config.dictConfig() with user-controlled input. This vulnerability is fixed in 1.3.0. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 55 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.10
0.19.11
0.19.12
0.19.13
0.19.14
0.19.15
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
0.19.9
1.0.0
1.0.0rc1
1.0.0rc2
1.0.0rc3
1.1.0
1.1.1
1.2.0
Fixed in
1.3.0
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-35167
PYSEC-2026-71
GHSA-6326-w46w-ppjw
Apr 06, 2026
8.1
/ 10
High
Network
Low
Low
None
Unchanged
High
High
None
Kedro is a toolbox for production-ready data science. Prior to 1.3.0, the _get_versioned_path() method in kedro/io/core.py constructs filesystem paths by directly interpolating user-supplied version strings without sanitization. Because version strings are used as path components, traversal sequences such as ../ are preserved and can escape the intended versioned dataset directory. This is reachable through multiple entry points: catalog.load(..., version=...), DataCatalog.from_config(..., load_versions=...), and the CLI via kedro run --load-versions=dataset:../../../secrets. An attacker who can influence the version string can force Kedro to load files from outside the intended version directory, enabling unauthorized file reads, data poisoning, or cross-tenant data access in shared environments. This vulnerability is fixed in 1.3.0. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 55 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.10
0.19.11
0.19.12
0.19.13
0.19.14
0.19.15
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
0.19.9
1.0.0
1.0.0rc1
1.0.0rc2
1.0.0rc3
1.1.0
1.1.1
1.2.0
Fixed in
1.3.0
References Updated May 20, 2026 · Source: OSV.dev | ||
0.17.7
patch
4 CVEs
CVE-2024-12215
PYSEC-2026-1485
GHSA-rm69-wvpv-r2w7
Jul 07, 2026
Kedro allows Remote Code Execution by Pulling Micro Packages
8.8
/ 10
High
Network
Low
None
Required
Unchanged
High
High
High
In kedro-org/kedro version 0.19.8, the Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 41 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-9701
PYSEC-2026-367
GHSA-747f-ww56-4q4h
Jun 29, 2026
Kedro deserialization vulnerability
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
A Remote Code Execution (RCE) vulnerability has been identified in the Kedro ShelveStore class (version 0.19.8). This vulnerability allows an attacker to execute arbitrary Python code via deserialization of malicious payloads, potentially leading to a full system compromise. The ShelveStore class uses Python's shelve module to manage session data, which relies on pickle for serialization. Crafting a malicious payload and storing it in the shelve file can lead to RCE when the payload is deserialized. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 41 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
Fixed in
0.19.9
References
Updated Jul 01, 2026 · Source: OSV.dev
CVE-2026-35171
PYSEC-2026-72
GHSA-9cqf-439c-j96r
Apr 06, 2026
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
Kedro is a toolbox for production-ready data science. Prior to 1.3.0, Kedro allows the logging configuration file path to be set via the KEDRO_LOGGING_CONFIG environment variable and loads it without validation. The logging configuration schema supports the special () key, which enables arbitrary callable instantiation. An attacker can exploit this to execute arbitrary system commands during application startup. This is a critical remote code execution (RCE) vulnerability caused by unsafe use of logging.config.dictConfig() with user-controlled input. This vulnerability is fixed in 1.3.0. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 55 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.10
0.19.11
0.19.12
0.19.13
0.19.14
0.19.15
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
0.19.9
1.0.0
1.0.0rc1
1.0.0rc2
1.0.0rc3
1.1.0
1.1.1
1.2.0
Fixed in
1.3.0
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-35167
PYSEC-2026-71
GHSA-6326-w46w-ppjw
Apr 06, 2026
8.1
/ 10
High
Network
Low
Low
None
Unchanged
High
High
None
Kedro is a toolbox for production-ready data science. Prior to 1.3.0, the _get_versioned_path() method in kedro/io/core.py constructs filesystem paths by directly interpolating user-supplied version strings without sanitization. Because version strings are used as path components, traversal sequences such as ../ are preserved and can escape the intended versioned dataset directory. This is reachable through multiple entry points: catalog.load(..., version=...), DataCatalog.from_config(..., load_versions=...), and the CLI via kedro run --load-versions=dataset:../../../secrets. An attacker who can influence the version string can force Kedro to load files from outside the intended version directory, enabling unauthorized file reads, data poisoning, or cross-tenant data access in shared environments. This vulnerability is fixed in 1.3.0. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 55 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.10
0.19.11
0.19.12
0.19.13
0.19.14
0.19.15
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
0.19.9
1.0.0
1.0.0rc1
1.0.0rc2
1.0.0rc3
1.1.0
1.1.1
1.2.0
Fixed in
1.3.0
References Updated May 20, 2026 · Source: OSV.dev | ||
0.17.6
patch
4 CVEs
CVE-2024-12215
PYSEC-2026-1485
GHSA-rm69-wvpv-r2w7
Jul 07, 2026
Kedro allows Remote Code Execution by Pulling Micro Packages
8.8
/ 10
High
Network
Low
None
Required
Unchanged
High
High
High
In kedro-org/kedro version 0.19.8, the Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 41 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-9701
PYSEC-2026-367
GHSA-747f-ww56-4q4h
Jun 29, 2026
Kedro deserialization vulnerability
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
A Remote Code Execution (RCE) vulnerability has been identified in the Kedro ShelveStore class (version 0.19.8). This vulnerability allows an attacker to execute arbitrary Python code via deserialization of malicious payloads, potentially leading to a full system compromise. The ShelveStore class uses Python's shelve module to manage session data, which relies on pickle for serialization. Crafting a malicious payload and storing it in the shelve file can lead to RCE when the payload is deserialized. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 41 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
Fixed in
0.19.9
References
Updated Jul 01, 2026 · Source: OSV.dev
CVE-2026-35171
PYSEC-2026-72
GHSA-9cqf-439c-j96r
Apr 06, 2026
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
Kedro is a toolbox for production-ready data science. Prior to 1.3.0, Kedro allows the logging configuration file path to be set via the KEDRO_LOGGING_CONFIG environment variable and loads it without validation. The logging configuration schema supports the special () key, which enables arbitrary callable instantiation. An attacker can exploit this to execute arbitrary system commands during application startup. This is a critical remote code execution (RCE) vulnerability caused by unsafe use of logging.config.dictConfig() with user-controlled input. This vulnerability is fixed in 1.3.0. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 55 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.10
0.19.11
0.19.12
0.19.13
0.19.14
0.19.15
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
0.19.9
1.0.0
1.0.0rc1
1.0.0rc2
1.0.0rc3
1.1.0
1.1.1
1.2.0
Fixed in
1.3.0
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-35167
PYSEC-2026-71
GHSA-6326-w46w-ppjw
Apr 06, 2026
8.1
/ 10
High
Network
Low
Low
None
Unchanged
High
High
None
Kedro is a toolbox for production-ready data science. Prior to 1.3.0, the _get_versioned_path() method in kedro/io/core.py constructs filesystem paths by directly interpolating user-supplied version strings without sanitization. Because version strings are used as path components, traversal sequences such as ../ are preserved and can escape the intended versioned dataset directory. This is reachable through multiple entry points: catalog.load(..., version=...), DataCatalog.from_config(..., load_versions=...), and the CLI via kedro run --load-versions=dataset:../../../secrets. An attacker who can influence the version string can force Kedro to load files from outside the intended version directory, enabling unauthorized file reads, data poisoning, or cross-tenant data access in shared environments. This vulnerability is fixed in 1.3.0. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 55 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.10
0.19.11
0.19.12
0.19.13
0.19.14
0.19.15
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
0.19.9
1.0.0
1.0.0rc1
1.0.0rc2
1.0.0rc3
1.1.0
1.1.1
1.2.0
Fixed in
1.3.0
References Updated May 20, 2026 · Source: OSV.dev | ||
0.17.5
patch
4 CVEs
CVE-2024-12215
PYSEC-2026-1485
GHSA-rm69-wvpv-r2w7
Jul 07, 2026
Kedro allows Remote Code Execution by Pulling Micro Packages
8.8
/ 10
High
Network
Low
None
Required
Unchanged
High
High
High
In kedro-org/kedro version 0.19.8, the Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 41 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-9701
PYSEC-2026-367
GHSA-747f-ww56-4q4h
Jun 29, 2026
Kedro deserialization vulnerability
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
A Remote Code Execution (RCE) vulnerability has been identified in the Kedro ShelveStore class (version 0.19.8). This vulnerability allows an attacker to execute arbitrary Python code via deserialization of malicious payloads, potentially leading to a full system compromise. The ShelveStore class uses Python's shelve module to manage session data, which relies on pickle for serialization. Crafting a malicious payload and storing it in the shelve file can lead to RCE when the payload is deserialized. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 41 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
Fixed in
0.19.9
References
Updated Jul 01, 2026 · Source: OSV.dev
CVE-2026-35171
PYSEC-2026-72
GHSA-9cqf-439c-j96r
Apr 06, 2026
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
Kedro is a toolbox for production-ready data science. Prior to 1.3.0, Kedro allows the logging configuration file path to be set via the KEDRO_LOGGING_CONFIG environment variable and loads it without validation. The logging configuration schema supports the special () key, which enables arbitrary callable instantiation. An attacker can exploit this to execute arbitrary system commands during application startup. This is a critical remote code execution (RCE) vulnerability caused by unsafe use of logging.config.dictConfig() with user-controlled input. This vulnerability is fixed in 1.3.0. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 55 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.10
0.19.11
0.19.12
0.19.13
0.19.14
0.19.15
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
0.19.9
1.0.0
1.0.0rc1
1.0.0rc2
1.0.0rc3
1.1.0
1.1.1
1.2.0
Fixed in
1.3.0
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-35167
PYSEC-2026-71
GHSA-6326-w46w-ppjw
Apr 06, 2026
8.1
/ 10
High
Network
Low
Low
None
Unchanged
High
High
None
Kedro is a toolbox for production-ready data science. Prior to 1.3.0, the _get_versioned_path() method in kedro/io/core.py constructs filesystem paths by directly interpolating user-supplied version strings without sanitization. Because version strings are used as path components, traversal sequences such as ../ are preserved and can escape the intended versioned dataset directory. This is reachable through multiple entry points: catalog.load(..., version=...), DataCatalog.from_config(..., load_versions=...), and the CLI via kedro run --load-versions=dataset:../../../secrets. An attacker who can influence the version string can force Kedro to load files from outside the intended version directory, enabling unauthorized file reads, data poisoning, or cross-tenant data access in shared environments. This vulnerability is fixed in 1.3.0. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 55 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.10
0.19.11
0.19.12
0.19.13
0.19.14
0.19.15
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
0.19.9
1.0.0
1.0.0rc1
1.0.0rc2
1.0.0rc3
1.1.0
1.1.1
1.2.0
Fixed in
1.3.0
References Updated May 20, 2026 · Source: OSV.dev | ||
0.17.4
patch
4 CVEs
CVE-2024-12215
PYSEC-2026-1485
GHSA-rm69-wvpv-r2w7
Jul 07, 2026
Kedro allows Remote Code Execution by Pulling Micro Packages
8.8
/ 10
High
Network
Low
None
Required
Unchanged
High
High
High
In kedro-org/kedro version 0.19.8, the Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 41 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-9701
PYSEC-2026-367
GHSA-747f-ww56-4q4h
Jun 29, 2026
Kedro deserialization vulnerability
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
A Remote Code Execution (RCE) vulnerability has been identified in the Kedro ShelveStore class (version 0.19.8). This vulnerability allows an attacker to execute arbitrary Python code via deserialization of malicious payloads, potentially leading to a full system compromise. The ShelveStore class uses Python's shelve module to manage session data, which relies on pickle for serialization. Crafting a malicious payload and storing it in the shelve file can lead to RCE when the payload is deserialized. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 41 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
Fixed in
0.19.9
References
Updated Jul 01, 2026 · Source: OSV.dev
CVE-2026-35171
PYSEC-2026-72
GHSA-9cqf-439c-j96r
Apr 06, 2026
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
Kedro is a toolbox for production-ready data science. Prior to 1.3.0, Kedro allows the logging configuration file path to be set via the KEDRO_LOGGING_CONFIG environment variable and loads it without validation. The logging configuration schema supports the special () key, which enables arbitrary callable instantiation. An attacker can exploit this to execute arbitrary system commands during application startup. This is a critical remote code execution (RCE) vulnerability caused by unsafe use of logging.config.dictConfig() with user-controlled input. This vulnerability is fixed in 1.3.0. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 55 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.10
0.19.11
0.19.12
0.19.13
0.19.14
0.19.15
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
0.19.9
1.0.0
1.0.0rc1
1.0.0rc2
1.0.0rc3
1.1.0
1.1.1
1.2.0
Fixed in
1.3.0
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-35167
PYSEC-2026-71
GHSA-6326-w46w-ppjw
Apr 06, 2026
8.1
/ 10
High
Network
Low
Low
None
Unchanged
High
High
None
Kedro is a toolbox for production-ready data science. Prior to 1.3.0, the _get_versioned_path() method in kedro/io/core.py constructs filesystem paths by directly interpolating user-supplied version strings without sanitization. Because version strings are used as path components, traversal sequences such as ../ are preserved and can escape the intended versioned dataset directory. This is reachable through multiple entry points: catalog.load(..., version=...), DataCatalog.from_config(..., load_versions=...), and the CLI via kedro run --load-versions=dataset:../../../secrets. An attacker who can influence the version string can force Kedro to load files from outside the intended version directory, enabling unauthorized file reads, data poisoning, or cross-tenant data access in shared environments. This vulnerability is fixed in 1.3.0. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 55 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.10
0.19.11
0.19.12
0.19.13
0.19.14
0.19.15
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
0.19.9
1.0.0
1.0.0rc1
1.0.0rc2
1.0.0rc3
1.1.0
1.1.1
1.2.0
Fixed in
1.3.0
References Updated May 20, 2026 · Source: OSV.dev | ||
0.17.3
patch
4 CVEs
CVE-2024-12215
PYSEC-2026-1485
GHSA-rm69-wvpv-r2w7
Jul 07, 2026
Kedro allows Remote Code Execution by Pulling Micro Packages
8.8
/ 10
High
Network
Low
None
Required
Unchanged
High
High
High
In kedro-org/kedro version 0.19.8, the Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 41 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-9701
PYSEC-2026-367
GHSA-747f-ww56-4q4h
Jun 29, 2026
Kedro deserialization vulnerability
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
A Remote Code Execution (RCE) vulnerability has been identified in the Kedro ShelveStore class (version 0.19.8). This vulnerability allows an attacker to execute arbitrary Python code via deserialization of malicious payloads, potentially leading to a full system compromise. The ShelveStore class uses Python's shelve module to manage session data, which relies on pickle for serialization. Crafting a malicious payload and storing it in the shelve file can lead to RCE when the payload is deserialized. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 41 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
Fixed in
0.19.9
References
Updated Jul 01, 2026 · Source: OSV.dev
CVE-2026-35171
PYSEC-2026-72
GHSA-9cqf-439c-j96r
Apr 06, 2026
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
Kedro is a toolbox for production-ready data science. Prior to 1.3.0, Kedro allows the logging configuration file path to be set via the KEDRO_LOGGING_CONFIG environment variable and loads it without validation. The logging configuration schema supports the special () key, which enables arbitrary callable instantiation. An attacker can exploit this to execute arbitrary system commands during application startup. This is a critical remote code execution (RCE) vulnerability caused by unsafe use of logging.config.dictConfig() with user-controlled input. This vulnerability is fixed in 1.3.0. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 55 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.10
0.19.11
0.19.12
0.19.13
0.19.14
0.19.15
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
0.19.9
1.0.0
1.0.0rc1
1.0.0rc2
1.0.0rc3
1.1.0
1.1.1
1.2.0
Fixed in
1.3.0
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-35167
PYSEC-2026-71
GHSA-6326-w46w-ppjw
Apr 06, 2026
8.1
/ 10
High
Network
Low
Low
None
Unchanged
High
High
None
Kedro is a toolbox for production-ready data science. Prior to 1.3.0, the _get_versioned_path() method in kedro/io/core.py constructs filesystem paths by directly interpolating user-supplied version strings without sanitization. Because version strings are used as path components, traversal sequences such as ../ are preserved and can escape the intended versioned dataset directory. This is reachable through multiple entry points: catalog.load(..., version=...), DataCatalog.from_config(..., load_versions=...), and the CLI via kedro run --load-versions=dataset:../../../secrets. An attacker who can influence the version string can force Kedro to load files from outside the intended version directory, enabling unauthorized file reads, data poisoning, or cross-tenant data access in shared environments. This vulnerability is fixed in 1.3.0. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 55 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.10
0.19.11
0.19.12
0.19.13
0.19.14
0.19.15
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
0.19.9
1.0.0
1.0.0rc1
1.0.0rc2
1.0.0rc3
1.1.0
1.1.1
1.2.0
Fixed in
1.3.0
References Updated May 20, 2026 · Source: OSV.dev | ||
0.17.2
patch
4 CVEs
CVE-2024-12215
PYSEC-2026-1485
GHSA-rm69-wvpv-r2w7
Jul 07, 2026
Kedro allows Remote Code Execution by Pulling Micro Packages
8.8
/ 10
High
Network
Low
None
Required
Unchanged
High
High
High
In kedro-org/kedro version 0.19.8, the Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 41 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-9701
PYSEC-2026-367
GHSA-747f-ww56-4q4h
Jun 29, 2026
Kedro deserialization vulnerability
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
A Remote Code Execution (RCE) vulnerability has been identified in the Kedro ShelveStore class (version 0.19.8). This vulnerability allows an attacker to execute arbitrary Python code via deserialization of malicious payloads, potentially leading to a full system compromise. The ShelveStore class uses Python's shelve module to manage session data, which relies on pickle for serialization. Crafting a malicious payload and storing it in the shelve file can lead to RCE when the payload is deserialized. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 41 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
Fixed in
0.19.9
References
Updated Jul 01, 2026 · Source: OSV.dev
CVE-2026-35171
PYSEC-2026-72
GHSA-9cqf-439c-j96r
Apr 06, 2026
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
Kedro is a toolbox for production-ready data science. Prior to 1.3.0, Kedro allows the logging configuration file path to be set via the KEDRO_LOGGING_CONFIG environment variable and loads it without validation. The logging configuration schema supports the special () key, which enables arbitrary callable instantiation. An attacker can exploit this to execute arbitrary system commands during application startup. This is a critical remote code execution (RCE) vulnerability caused by unsafe use of logging.config.dictConfig() with user-controlled input. This vulnerability is fixed in 1.3.0. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 55 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.10
0.19.11
0.19.12
0.19.13
0.19.14
0.19.15
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
0.19.9
1.0.0
1.0.0rc1
1.0.0rc2
1.0.0rc3
1.1.0
1.1.1
1.2.0
Fixed in
1.3.0
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-35167
PYSEC-2026-71
GHSA-6326-w46w-ppjw
Apr 06, 2026
8.1
/ 10
High
Network
Low
Low
None
Unchanged
High
High
None
Kedro is a toolbox for production-ready data science. Prior to 1.3.0, the _get_versioned_path() method in kedro/io/core.py constructs filesystem paths by directly interpolating user-supplied version strings without sanitization. Because version strings are used as path components, traversal sequences such as ../ are preserved and can escape the intended versioned dataset directory. This is reachable through multiple entry points: catalog.load(..., version=...), DataCatalog.from_config(..., load_versions=...), and the CLI via kedro run --load-versions=dataset:../../../secrets. An attacker who can influence the version string can force Kedro to load files from outside the intended version directory, enabling unauthorized file reads, data poisoning, or cross-tenant data access in shared environments. This vulnerability is fixed in 1.3.0. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 55 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.10
0.19.11
0.19.12
0.19.13
0.19.14
0.19.15
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
0.19.9
1.0.0
1.0.0rc1
1.0.0rc2
1.0.0rc3
1.1.0
1.1.1
1.2.0
Fixed in
1.3.0
References Updated May 20, 2026 · Source: OSV.dev | ||
0.17.1
patch
4 CVEs
CVE-2024-12215
PYSEC-2026-1485
GHSA-rm69-wvpv-r2w7
Jul 07, 2026
Kedro allows Remote Code Execution by Pulling Micro Packages
8.8
/ 10
High
Network
Low
None
Required
Unchanged
High
High
High
In kedro-org/kedro version 0.19.8, the Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 41 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-9701
PYSEC-2026-367
GHSA-747f-ww56-4q4h
Jun 29, 2026
Kedro deserialization vulnerability
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
A Remote Code Execution (RCE) vulnerability has been identified in the Kedro ShelveStore class (version 0.19.8). This vulnerability allows an attacker to execute arbitrary Python code via deserialization of malicious payloads, potentially leading to a full system compromise. The ShelveStore class uses Python's shelve module to manage session data, which relies on pickle for serialization. Crafting a malicious payload and storing it in the shelve file can lead to RCE when the payload is deserialized. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 41 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
Fixed in
0.19.9
References
Updated Jul 01, 2026 · Source: OSV.dev
CVE-2026-35171
PYSEC-2026-72
GHSA-9cqf-439c-j96r
Apr 06, 2026
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
Kedro is a toolbox for production-ready data science. Prior to 1.3.0, Kedro allows the logging configuration file path to be set via the KEDRO_LOGGING_CONFIG environment variable and loads it without validation. The logging configuration schema supports the special () key, which enables arbitrary callable instantiation. An attacker can exploit this to execute arbitrary system commands during application startup. This is a critical remote code execution (RCE) vulnerability caused by unsafe use of logging.config.dictConfig() with user-controlled input. This vulnerability is fixed in 1.3.0. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 55 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.10
0.19.11
0.19.12
0.19.13
0.19.14
0.19.15
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
0.19.9
1.0.0
1.0.0rc1
1.0.0rc2
1.0.0rc3
1.1.0
1.1.1
1.2.0
Fixed in
1.3.0
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-35167
PYSEC-2026-71
GHSA-6326-w46w-ppjw
Apr 06, 2026
8.1
/ 10
High
Network
Low
Low
None
Unchanged
High
High
None
Kedro is a toolbox for production-ready data science. Prior to 1.3.0, the _get_versioned_path() method in kedro/io/core.py constructs filesystem paths by directly interpolating user-supplied version strings without sanitization. Because version strings are used as path components, traversal sequences such as ../ are preserved and can escape the intended versioned dataset directory. This is reachable through multiple entry points: catalog.load(..., version=...), DataCatalog.from_config(..., load_versions=...), and the CLI via kedro run --load-versions=dataset:../../../secrets. An attacker who can influence the version string can force Kedro to load files from outside the intended version directory, enabling unauthorized file reads, data poisoning, or cross-tenant data access in shared environments. This vulnerability is fixed in 1.3.0. Affected versions
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
+ 55 more Show less
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.10
0.19.11
0.19.12
0.19.13
0.19.14
0.19.15
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
0.19.9
1.0.0
1.0.0rc1
1.0.0rc2
1.0.0rc3
1.1.0
1.1.1
1.2.0
Fixed in
1.3.0
References Updated May 20, 2026 · Source: OSV.dev |