Arbitrary Code Execution in Kedro-Datasets from Kedro
CVE-2026-62997
7.7HIGH
What is CVE-2026-62997?
Kedro-Datasets, a plugin for Kedro, is affected by a vulnerability that permits arbitrary code execution when user-supplied model files are loaded. Specifically, from Kedro-Datasets versions 5.0.0 to 9.4.9, the PyTorchDataset class fails to enforce weight restrictions while loading .pt model files, allowing an attacker to exploit untrusted models from shared or external sources. This could lead to executing arbitrary code on the system. Users are advised to update to version 9.5.0 or later to mitigate this risk.
Affected Version(s)
kedro-plugins >= 5.0.0, < 9.5.0