PatchSiren cyber security CVE debrief

CVE-2026-3840 kedro-org CVE debrief

A high-severity path traversal vulnerability exists in Kedro version 1.2.0. The `_get_versioned_path()` method in `kedro/io/core.py` directly interpolates user-supplied version strings into filesystem paths without sanitization, allowing an attacker to escape the intended versioned dataset directory and access files outside the expected path. This issue is also reachable through the CLI via the `--load-versions` parameter, as `_split_load_versions()` in `kedro/framework/cli/utils.py` does not validate the version string. Successful exploitation can lead to unauthorized file reads, data poisoning, cross-project or cross-tenant data access, and broader downstream impacts in environments where Kedro is used with automation or orchestration layers.