CVE-2026-35171 | Kedro is a toolbox for production-ready data science. Prior … | CVSS 9.8 CRITICAL

Description

Kedro is a toolbox for production-ready data science. Prior to 1.3.0, Kedro allows the logging configuration file path to be set via the KEDRO_LOGGING_CONFIG environment variable and loads it without validation. The logging configuration schema supports the special () key, which enables arbitrary callable instantiation. An attacker can exploit this to execute arbitrary system commands during application startup. This is a critical remote code execution (RCE) vulnerability caused by unsafe use of logging.config.dictConfig() with user-controlled input. This vulnerability is fixed in 1.3.0.

Metadata

CVE ID: CVE-2026-35171
State: PUBLISHED
Assigner: GitHub_M
Reserved: 2026-04-01 17:26 UTC
Published: 2026-04-06 17:45 UTC
Last updated: 2026-04-07 15:10 UTC
Primary CWE: CWE-94
CWE-94: Improper Control of Generation of Code ('Code Inject…
Vendor / Product: kedro-org / kedro
Sources: cve.org · NVD

Severity & Metrics

9.8 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: none
Automatable: yes
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
kedro-org	kedro	—	< 1.3.0

Weakness (CWE)

CWE	Source	Description
CWE-502	cna	CWE-502: Deserialization of Untrusted Data
CWE-94	cna	CWE-94: Improper Control of Generation of Code ('Code Injection')

CVSS scores (1)

Score	Severity	Version	Source	Vector
9.8	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References (1)

https://github.com/kedro-org/kedro/security/advisories/GHSA-9cqf-439c-j96r https://github.com/kedro-org/kedro/security/advisories/GHSA-9cqf-439c-j96r