PT-2026-30759 · Unknown · Kedro-Datasets

Redyank · Published 2026-04-06 · Updated 2026-04-07 · CVE-2026-35492

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Kedro-Datasets versions prior to 9.3.0

Description The Kedro-Datasets plugin is susceptible to a path traversal issue in the PartitionedDataset component. Partition IDs were directly concatenated with the dataset base path without proper validation. Malicious input containing '..' components within a partition ID could allow an attacker to write files outside the intended dataset directory, potentially overwriting arbitrary files on the filesystem. This affects users of PartitionedDataset with any storage backend (local filesystem, S3, GCS, etc.).

Recommendations Upgrade to kedro-datasets version 9.3.0 or later. As a temporary workaround, validate partition IDs before passing them to PartitionedDataset, ensuring they do not contain '..' path components.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-35492

GHSA-CJG8-H5QC-HRJV

Affected Products

Kedro-Datasets

References · 9

• https://osv.dev/vulnerability/GHSA-cjg8-h5qc-hrjv · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-35492 · Security Note
• https://github.com/kedro-org/kedro/issues/5452 · Note
• https://github.com/kedro-org/kedro-plugins/commit/65115f76b872217317734b6bde8927170c98fc4b · Note
• https://github.com/kedro-org/kedro-plugins/releases/tag/kedro-datasets-9.3.0 · Note
• https://github.com/kedro-org/kedro-plugins/pull/1346 · Note
• https://github.com/kedro-org/kedro-plugins/security/advisories/GHSA-cjg8-h5qc-hrjv · Note
• https://github.com/kedro-org/kedro-plugins · Note
• https://twitter.com/CVEnew/status/2041603220775010348 · Twitter Post