CVE-2026-62997
HighCVSS 7.7Exploitation Probability (EPSS)
Elevated risk51th percentile - higher than 51% of all known CVEs
Summary
Kedro-Datasets provides data connectors for Kedro. From version 5.0.0 until 9.5.0, kedro_datasets_experimental.pytorch.PyTorchDataset in kedro-datasets loads .pt model files with torch.load without enforcing weights_only=True, and user-supplied load_args are silently dropped. On PyTorch versions earlier than 2.6, a malicious pickle-backed model from an attacker-influenced shared registry, downloaded checkpoint, or partitioned external source can execute arbitrary code when a Kedro pipeline loads it.
Risk Assessment
An attacker can supply a malicious model file via a shared registry, checkpoint, or external source and achieve code execution in the environment running the Kedro pipeline. The issue affects only the opt-in experimental component.
Recommendation
Update kedro-datasets to version 9.5.0 or later. Load only trusted model files and consider upgrading PyTorch to version 2.6 or later.
Other vulnerabilities in Kedro-Datasets
See all- CVE-2026-111170Medium
kedro-datasets from 9.3.0 through 9.6.0 contains a path traversal vulnerability in MatplotlibDataset.save() that allows attackers to write files outside the dataset directory by supplying absolute plot names. Because validate_sub_path() strips leading slashes while pathlib's join discards the base path, attackers can create or overwrite files anywhere the process can write.
- CVE-2026-35492Medium
In Kedro-Datasets prior to 9.3.0, PartitionedDataset is vulnerable to path traversal because partition IDs are concatenated directly with the base path without validation. A malicious partition ID containing .. components can cause files to be written outside the configured directory, potentially overwriting arbitrary files.
Original NVD description (English source)
Kedro-Datasets provides data connectors for Kedro. From version 5.0.0 until 9.5.0, kedro_datasets_experimental.pytorch.PyTorchDataset in kedro-datasets loads .pt model files with torch.load without enforcing weights_only=True, and user-supplied load_args are silently dropped. On PyTorch versions earlier than 2.6, a malicious pickle-backed model from an attacker-influenced shared registry, downloaded checkpoint, or partitioned external source can execute arbitrary code when a Kedro pipeline loads it. The issue affects only the opt-in kedro_datasets_experimental component and does not affect users who load only trusted files. This issue is fixed in version 9.5.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS