CVE-2026-35492

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-35492
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-35492.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-35492
Aliases
Published
2026-04-07T15:03:45.893Z
Modified
2026-07-08T08:13:02.661675971Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
Summary
Kedro-Datasets has a path traversal vulnerability in PartitionedDataset allows arbitrary file write
Details

Kedro-Datasets is a Kendo plugin providing data connectors. Prior to 9.3.0, PartitionedDataset in kedro-datasets was vulnerable to path traversal. Partition IDs were concatenated directly with the dataset base path without validation. An attacker or malicious input containing .. components in a partition ID could cause files to be written outside the configured dataset directory, potentially overwriting arbitrary files on the filesystem. Users of PartitionedDataset with any storage backend (local filesystem, S3, GCS, etc.) are affected. This vulnerability is fixed in 9.3.0.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/35xxx/CVE-2026-35492.json",
    "cwe_ids": [
        "CWE-22"
    ],
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/kedro-org/kedro-plugins

Affected ranges

Type
GIT
Repo
https://github.com/kedro-org/kedro-plugins
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
b211f045df8bd0bda147354b59614ad337a2a741
Database specific 
{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "9.3.0"
        }
    ]
}

Affected versions

kedro-airflow-0.*
kedro-airflow-0.10.0
kedro-airflow-0.4.2
kedro-airflow-0.5.0
kedro-airflow-0.5.1
kedro-airflow-0.6.0
kedro-airflow-0.7.0
kedro-airflow-0.8.0
kedro-airflow-0.9.0
kedro-airflow-0.9.1
kedro-airflow-0.9.2
kedro-datasets-0.*
kedro-datasets-0.0.2
kedro-datasets-0.0.3
kedro-datasets-0.0.4
kedro-datasets-1.*
kedro-datasets-1.0.0
kedro-datasets-1.0.1
kedro-datasets-1.0.2
kedro-datasets-1.1.0
kedro-datasets-1.1.1
kedro-datasets-1.2.0
kedro-datasets-1.3.0
kedro-datasets-1.4.0
kedro-datasets-1.4.1
kedro-datasets-1.4.2
kedro-datasets-1.5.0
kedro-datasets-1.5.1
kedro-datasets-1.5.2
kedro-datasets-1.5.3
kedro-datasets-1.6.0
kedro-datasets-1.7.0
kedro-datasets-1.7.1
kedro-datasets-1.8.0
kedro-datasets-2.*
kedro-datasets-2.0.0
kedro-datasets-2.1.0
kedro-datasets-3.*
kedro-datasets-3.0.0
kedro-datasets-3.0.1
kedro-datasets-4.*
kedro-datasets-4.0.0
kedro-datasets-4.1.0
kedro-datasets-5.*
kedro-datasets-5.0.0
kedro-datasets-5.1.0
kedro-datasets-6.*
kedro-datasets-6.0.0
kedro-datasets-7.*
kedro-datasets-7.0.0
kedro-datasets-8.*
kedro-datasets-8.0.0
kedro-datasets-8.1.0
kedro-datasets-9.*
kedro-datasets-9.0.0
kedro-datasets-9.1.0
kedro-datasets-9.1.1
kedro-datasets-9.2.0
kedro-docker-0.*
kedro-docker-0.3.0
kedro-docker-0.3.1
kedro-docker-0.4.0
kedro-docker-0.5.0
kedro-docker-0.6.0
kedro-docker-0.6.1
kedro-docker-0.6.2
kedro-telemetry-0.*
kedro-telemetry-0.1.4
kedro-telemetry-0.2.0
kedro-telemetry-0.2.1
kedro-telemetry-0.2.2
kedro-telemetry-0.2.3
kedro-telemetry-0.2.4
kedro-telemetry-0.2.5
kedro-telemetry-0.3.0
kedro-telemetry-0.3.1
kedro-telemetry-0.3.2
kedro-telemetry-0.4.0
kedro-telemetry-0.5.0
kedro-telemetry-0.6.0
kedro-telemetry-0.6.1
kedro-telemetry-0.6.2
kedro-telemetry-0.6.3
kedro-telemetry-0.6.4
kedro-telemetry-0.6.5
kedro-telemetry-0.7.0
kedro-telemtery-v0.*
kedro-telemtery-v0.2.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-35492.json"