kedro-datasets has a path traversal vulnerability in PartitionedDataset that allows arbitrary file write
Impact
PartitionedDataset in kedro-datasets was vulnerable to path traversal. Partition IDs were concatenated directly with the dataset base path without validation. An attacker or malicious input containing .. components in a partition ID could cause files to be written outside the configured dataset directory, potentially overwriting arbitrary files on the filesystem. Users of PartitionedDataset with any storage backend (local filesystem, S3, GCS, etc.) are affected.
Patches
Yes. The vulnerability has been patched in kedro-datasets version 9.3.0.
Users should upgrade to kedro-datasets >= 9.3.0. The fix normalizes constructed paths using posixpath.normpath and validates that the resolved path remains within the dataset base directory before use, raising a DatasetError if the path escapes the base directory.
Workarounds
Users who cannot upgrade should validate partition IDs before passing them to PartitionedDataset, ensuring they do not contain .. path components.
References
Fix: https://github.com/kedro-org/kedro-plugins/pull/1346 Report: https://github.com/kedro-org/kedro/issues/5452
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Python (PyPI) | kedro-datasets | < 9.3.0 | 9.3.0 |
Referencias
- https://github.com/kedro-org/kedro-plugins/security/advisories/GHSA-cjg8-h5qc-hrjv
- https://nvd.nist.gov/vuln/detail/CVE-2026-35492
- https://github.com/kedro-org/kedro/issues/5452
- https://github.com/kedro-org/kedro-plugins/pull/1346
- https://github.com/kedro-org/kedro-plugins/commit/65115f76b872217317734b6bde8927170c98fc4b
- https://github.com/kedro-org/kedro-plugins
- https://github.com/kedro-org/kedro-plugins/releases/tag/kedro-datasets-9.3.0
- https://pypi.org/project/kedro-datasets
- https://github.com/advisories/GHSA-cjg8-h5qc-hrjv
- Vector CVSS
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N- Debilidad (CWE)
CWE-22- Plataforma
- Python (PyPI)
- Paquete
kedro-datasets- Publicada
- 06.04.2026
- Actualizado
- 16.10.2026 13:17
Fuentes y licencias
OSV / GitHub Advisory Database - PYSEC-2026-2545 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-cjg8-h5qc-hrjv - CC BY 4.0
Historial de vulnerabilidades: kedro-datasets
Todas las vulnerabilidades publicadas de este paquete (Python (PyPI)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
Esta es la única vulnerabilidad conocida de este paquete.
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.