kedro vulnerabilities

2 known vulnerabilities in kedro from Kedro-org. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  kedro: Improper Control of Generation of Code

  CVE-2026-35171Apr 6, 2026Kedro-org

  Kedro is a toolbox for production-ready data science. Prior to 1.3.0, Kedro allows the logging configuration file path to be set via the KEDRO_LOGGING_CONFIG environment variable and loads it without validation. The logging configuration schema supports the sp

• 8.1 High severity

  kedro: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2026-35167Apr 6, 2026Kedro-org

  Kedro is a toolbox for production-ready data science. Prior to 1.3.0, the _get_versioned_path() method in kedro/io/core.py constructs filesystem paths by directly interpolating user-supplied version strings without sanitization. Because version strings are use