AI Sec Watch: A Security Intelligence Platform for AI Systems

Luu, T.J.

GHSA-cjg8-h5qc-hrjv: kedro-datasets has a path traversal vulnerability in PartitionedDataset that allows arbitrary file write

mediumvulnerability

security

Source: GitHub Advisory DatabaseApril 6, 2026CVE-2026-35492

Summary

PartitionedDataset in kedro-datasets had a path traversal vulnerability (a security flaw where an attacker uses ".." sequences to access files outside an intended directory) that allowed attackers to write files anywhere on a system by including ".." in partition IDs (identifiers for data sections). This affected all users regardless of storage type, local or cloud-based.

Solution / Mitigation

Upgrade to kedro-datasets version 9.3.0 or later. The patch normalizes paths using `posixpath.normpath` and validates that resolved paths stay within the dataset base directory before use, raising a `DatasetError` if the path escapes. For users unable to upgrade, manually validate partition IDs to ensure they do not contain ".." path components before passing them to PartitionedDataset.