CVE-2026-35171criticalCWE-502CWE-94

CVE-2026-35171: fallo crítico en kedro-org kedro

Arbitrary Code Execution via Malicious Logging Configuration in Kedro

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear kedro+ Monitorear kedro

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

28Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 9.8epss 0.7%
Kedro is a toolbox for production-ready data science. Prior to 1.3.0, Kedro allows the logging configuration file path to be set via the KEDRO_LOGGING_CONFIG environment variable and loads it without validation. The logging configuration schema supports the special () key, which enables arbitrary callable instantiation. An attacker can exploit this to execute arbitrary system commands during application startup. This is a critical remote code execution (RCE) vulnerability caused by unsafe use of logging.config.dictConfig() with user-controlled input. This vulnerability is fixed in 1.3.0.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Productos afectados
kedro-org · kedro
CVEs relacionadas — kedro-org kedro

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-35167HIGHKedro has a path traversal in versioned dataset loading via unsanitized version stringEPSS 0.3%