{"data":{"id":"c68ea6b6-e7b5-430d-b517-5e53b0f1451b","title":"CVE-2026-62997: Kedro-Datasets provides data connectors for Kedro. From version 5.0.0 until 9.5.0, kedro_datasets_experimental.pytorch.P","summary":"Kedro-Datasets (a tool that connects data sources to Kedro, a framework for building data pipelines) had a vulnerability in versions 5.0.0 through 9.5.0 where its PyTorch model loader didn't safely load .pt files, allowing attackers to run arbitrary code (RCE, remote code execution) if someone loads a malicious model file from an untrusted source on PyTorch versions before 2.6. This only affected users of the optional experimental component and only when loading untrusted files.","solution":"Update kedro-datasets to version 9.5.0 or later.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-62997","publishedAt":"2026-09-16T21:17:12.990Z","cveId":"CVE-2026-62997","cweIds":["CWE-502"],"cvssScore":null,"cvssSeverity":null,"severity":"high","attackType":["model_poisoning","supply_chain"],"issueType":"vulnerability","affectedPackages":null,"affectedVendors":["HuggingFace"],"affectedVendorsRaw":["Kedro","Kedro-Datasets","PyTorch"],"classifierModel":"claude-haiku-4-5-20251001","classifierPromptVersion":"v3","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0,"patchAvailable":null,"disclosureDate":"2026-09-16T21:17:12.990Z","capecIds":["CAPEC-586"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["integrity","confidentiality"],"aiComponentTargeted":"training_data","llmSpecific":false,"classifierConfidence":0.92,"researchCategory":null,"atlasIds":["AML.T0010"]}}