Kedro allows an attacker to influence the version string supplied to dataset loading methods. The _get_versioned_path function builds the file path by inserting this string directly, without sanitization, so traversal sequences such as '../' are preserved. This permits enumeration and reading of files that lie outside the designated versioned dataset directory. An attacker who can control the version parameter can therefore read arbitrary files, inject malicious data into the data pipeline (data poisoning), or access data belonging to other tenants when multiple users share a Kedro deployment. The weakness maps to CWE‑22, File System Traversal.

Products affected are Kedro released by kedro-org. Versions earlier than 1.3.0 are vulnerable. The issue can be triggered in any context that calls the catalog.load method with a version argument, the DataCatalog.from_config constructor when load_versions is used, or the command‑line interface via the --load-versions option. Users of Kedro 1.2.x, 1.2.y, or any earlier 1.x release should verify whether their deployment has exposed a version string that could be manipulated.

The CVSS score of 7.1 indicates high potential for impact, but the EPSS score is below 1%, suggesting few publicly available exploits. The vulnerability is not listed in CISA's KEV catalog. Exploitation requires an attacker to supply or influence a version string in a call to catalog.load or its equivalents. In shared or multi‑tenant environments, this gives the attacker access to data that should be isolated, which could lead to confidentiality breaches or data corruption. Regular patching and input validation are therefore recommended.