CVE-2026-3840

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-3840

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-3840.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-3840

Published

2026-06-12T15:45:39.873Z

Modified

2026-07-15T01:48:50.175426672Z

Severity

7.1 (High) CVSS_V3 - CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N CVSS Calculator

Summary

Path Traversal in kedro-org/kedro

Details

A vulnerability in Kedro version 1.2.0 allows an attacker to exploit path traversal by providing a crafted version string. The _get_versioned_path() method in kedro/io/core.py directly interpolates user-supplied version strings into filesystem paths without sanitization. This enables an attacker to escape the intended versioned dataset directory and access files outside the expected path. The issue is also reachable through the CLI via the --load-versions parameter, as _split_load_versions() in kedro/framework/cli/utils.py does not validate the version string. This vulnerability can lead to unauthorized file reads, data poisoning, cross-project or cross-tenant data access, and broader downstream impacts in environments where Kedro is used with automation or orchestration layers.

Database specific

{
    "cwe_ids": [
        "CWE-22"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/3xxx/CVE-2026-3840.json",
    "cna_assigner": "@huntr_ai"
}

References

Affected packages

Git / github.com/kedro-org/kedro

Affected ranges

Type

GIT

Repo

https://github.com/kedro-org/kedro

Events

Introduced

fcb6b056bc39c8945c59b5d0dd4d90d16bd94425

Last affected

fcb6b056bc39c8945c59b5d0dd4d90d16bd94425

Database specific

{
    "cpe": "cpe:2.3:a:linuxfoundation:kedro:1.2.0:*:*:*:*:python:*:*",
    "extracted_events": [
        {
            "introduced": "1.2.0"
        },
        {
            "last_affected": "1.2.0"
        }
    ],
    "source": "CPE_STRING"
}

Affected versions

1.*

1.2.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-3840.json"