CVE-2026-35171

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-35171
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-35171.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-35171
Aliases
Published
2026-04-06T17:45:45.664Z
Modified
2026-07-08T08:12:59.214424768Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Arbitrary Code Execution via Malicious Logging Configuration in Kedro
Details

Kedro is a toolbox for production-ready data science. Prior to 1.3.0, Kedro allows the logging configuration file path to be set via the KEDROLOGGINGCONFIG environment variable and loads it without validation. The logging configuration schema supports the special () key, which enables arbitrary callable instantiation. An attacker can exploit this to execute arbitrary system commands during application startup. This is a critical remote code execution (RCE) vulnerability caused by unsafe use of logging.config.dictConfig() with user-controlled input. This vulnerability is fixed in 1.3.0.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/35xxx/CVE-2026-35171.json",
    "cwe_ids": [
        "CWE-502",
        "CWE-94"
    ],
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/kedro-org/kedro

Affected ranges

Type
GIT
Repo
https://github.com/kedro-org/kedro
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
d1af1822687a438a0f3fba8913a919d06e02c298
Database specific 
{
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ],
    "cpe": "cpe:2.3:a:linuxfoundation:kedro:*:*:*:*:*:python:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.3.0"
        }
    ]
}

Affected versions

0.*
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
0.15.8
0.15.9
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.18.1
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.19.0
0.19.1
0.19.10
0.19.11
0.19.12
0.19.13
0.19.14
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
0.19.9
1.*
1.0.0
1.0.0rc1
1.0.0rc2
1.0.0rc3
1.1.0
1.1.1
1.2.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-35171.json"