Path Traversal Vulnerability in Kedro-Datasets Plugin by Kendo
CVE-2026-35492
Key Information:
- Vendor
Kedro-org
- Status
- Vendor
- CVE Published:
- 7 April 2026
Badges
What is CVE-2026-35492?
The Kedro-Datasets, a Kendo plugin for data connectors, contains a vulnerability in the PartitionedDataset component. Prior to version 9.3.0, this component fails to adequately validate partition IDs, allowing attackers to exploit this weakness through malicious input that includes '..' sequences. This could lead to unauthorized file writing outside the intended dataset directory, with the potential to overwrite important files on the filesystem. Users employing PartitionedDataset with any storage backend, including local filesystems and cloud services like S3 or GCS, are at risk. The issue has been resolved in version 9.3.0.
Affected Version(s)
kedro-plugins < 9.3.0
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.