| Package | Affected versions | Patched versions |
|---|---|---|
| kedro | < 1.3.0 | 1.3.0 |
| kedro | < 1.3.0 | 1.3.0 |
The _get_versioned_path() method in kedro/io/core.py constructs filesystem paths by directly interpolating user-supplied version strings without sanitization. Because version strings are used as path components, traversal sequences such as ../ are preserved and can escape the intended versioned dataset directory.
This is reachable through multiple entry points: catalog.load(..., version=...), DataCatalog.from_config(..., load_versions=...), and the CLI via kedro run --load-versions=dataset:../../../secrets. An attacker who can influence the version string can force Kedro to load files from outside the intended version directory, enabling unauthorized file reads, data poisoning, or cross-tenant data access in shared environments.
Yes. Fixed in kedro version 1.3.0. Users should upgrade to kedro >= 1.3.0.
Validate version strings before passing them to DataCatalog or the CLI, ensuring they do not contain .. segments, path separators, or absolute paths.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free