Path Traversal Risk in Kedro Data Science Tool by Iterative

CVE-2026-35167

What is CVE-2026-35167?

Kedro, a popular toolbox for production-grade data science, is susceptible to a path traversal vulnerability. The issue arises in the _get_versioned_path() method, where user-supplied version strings are directly interpolated into filesystem paths without proper sanitization. This flaw allows attackers to maintain traversal sequences (like ../) in their input, enabling them to escape the designated versioned dataset directory. Through various entry points such as catalog.load(..., version=...) or the CLI command kedro run --load-versions=dataset:../../../secrets, a malicious actor could trick Kedro into accessing files outside the intended directory. This could result in unauthorized file reads, potential data poisoning, or cross-tenant data exposure in shared environments. The vulnerability has been remedied in Kedro version 1.3.0.

References