Kedro CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

HIGH Kedro CVE published 2026-04-06

CVE-2026-35167

CVE-2026-35167 is a vulnerability in Kedro, a toolbox for production-ready data science. The _get_versioned_path() method in kedro/io/core.py constructs filesystem paths by directly interpolating user-supplied version strings without sanitization, allowing traversal sequences such as ../ to escape the intended versioned dataset directory. This vulnerability is reachable through multiple entry points and c [truncated]