CVE-2026-3840

Name of the Vulnerable Software and Affected Versions Kedro version 1.2.0

Description An issue allows path traversal when a crafted version string is provided. The get versioned path() method in kedro/io/core.py interpolates user-supplied version strings into filesystem paths without sanitization, enabling access to files outside the intended versioned dataset directory. This is also reachable through the CLI via the --load-versions parameter because the split load versions() method in kedro/framework/cli/utils.py does not validate the version string. This can lead to unauthorized file reads, data poisoning, and cross-project or cross-tenant data access.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.