kedro-org/kedro vulnerabilities

3 known vulnerabilities in kedro-org/kedro from Kedro-org. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.1 High severity

  kedro-org/kedro: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2026-3840Jun 12, 2026Kedro-org

  A vulnerability in Kedro version 1.2.0 allows an attacker to exploit path traversal by providing a crafted version string. The `_get_versioned_path()` method in `kedro/io/core.py` directly interpolates user-supplied version strings into filesystem paths withou

• 9.8 Critical severity

  kedro-org/kedro: Deserialization of Untrusted Data

  CVE-2024-9701Mar 20, 2025Kedro-orgEPSS 1.14%

  A Remote Code Execution (RCE) vulnerability has been identified in the Kedro ShelveStore class (version 0.19.8). This vulnerability allows an attacker to execute arbitrary Python code via deserialization of malicious payloads, potentially leading to a full sys

• 8.8 High severity

  kedro-org/kedro: Improper Control of Generation of Code

  CVE-2024-12215Mar 20, 2025Kedro-orgEPSS 1.08%

  In kedro-org/kedro version 0.19.8, the `pull_package()` API function allows users to download and extract micro packages from the Internet. However, the function `project_wheel_metadata()` within the code path can execute the `setup.py` file inside the tar fil