CVE-2026-35167

OVERVIEW CVE-2026-35167 is a path traversal vulnerability in Kedro, an open-source data science toolbox for production-ready applications. The flaw exists in the _get_versioned_path() method within kedro/io/core.py, where user-supplied version strings are interpolated directly into filesystem paths without proper sanitization. This allows attackers to use traversal sequences such as ../ to escape the intended dataset directory and access files outside the designated versioned paths. SEVERITY The vulnerability carries a CVSS score of 8.1 (HIGH) with a network-based attack vector requiring only low privilege access and no user interaction. An attacker who can influence the version string through multiple entry points—including the catalog.load() method, DataCatalog configuration loading, or CLI arguments like kedro run --load-versions—can exploit this flaw. The impact includes unauthorized file reads, data poisoning of datasets, and potential cross-tenant data access in shared environments, though the vulnerability does not directly enable system availability disruption. EXPLOITATION STATUS There is no evidence of active exploitation in the wild, with an EPSS score of 0.000190000 indicating minimal current threat activity. The vulnerability does not appear on the Known Exploited Vulnerabilities (KEV) catalog and remains inactive on threat intelligence hot lists. Kedro developers addressed this issue in version 1.3.0, and organizations using earlier versions should prioritize patching to eliminate exposure to this path traversal risk.