Vulnerability · Published Jun 12, 2026 · Assigned by @huntr_ai
CVE-2026-3840Path Traversal in kedro-org/kedro
High 7.1
In plain English
A high-severity path traversal in kedro-org/kedro from kedro-org. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities).
Official description
A vulnerability in Kedro version 1.2.0 allows an attacker to exploit path traversal by providing a crafted version string. The `_get_versioned_path()` method in `kedro/io/core.py` directly interpolates user-supplied version strings into filesystem paths without sanitization. This enables an attacker to escape the intended versioned dataset directory and access files outside the expected path. The issue is also reachable through the CLI via the `--load-versions` parameter, as `_split_load_versions()` in `kedro/framework/cli/utils.py` does not validate the version string. This vulnerability can lead to unauthorized file reads, data poisoning, cross-project or cross-tenant data access, and broader downstream impacts in environments where Kedro is used with automation or orchestration layers.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| kedro-org | kedro-org/kedro | unspecified – through latest |
Weakness: CWE-22 · Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N