{"id":"CVE-2026-62997","title":"Kedro-Datasets provides data connectors for Kedro","summary":"Kedro-Datasets provides data connectors for Kedro. From version 5.0.0 until 9.5.0, kedro_datasets_experimental.pytorch.PyTorchDataset in kedro-datasets loads .pt model files with torch.load without enforcing weights_only=True, and user-s…","severity":"high","cvss":7.7,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","cwe":["CWE-502"],"vendor":"kedro-org","product":"kedro-plugins","affected":["kedro-plugins >= 5.0.0, < 9.5.0"],"published":"2026-09-16","updated":"2026-09-17","sourceUpdated":"2026-09-17T15:16:49.157","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-62997","references":[{"url":"https://github.com/kedro-org/kedro-plugins/commit/4d6deb7a7ecba483d33fd43e2a6c063bcf22f413","label":"security-advisories@github.com"},{"url":"https://github.com/kedro-org/kedro-plugins/issues/1431","label":"security-advisories@github.com"},{"url":"https://github.com/kedro-org/kedro-plugins/pull/1433","label":"security-advisories@github.com"},{"url":"https://github.com/kedro-org/kedro-plugins/releases/tag/kedro-datasets-9.5.0","label":"security-advisories@github.com"},{"url":"https://github.com/kedro-org/kedro-plugins/security/advisories/GHSA-f9q4-h45w-jrrq","label":"security-advisories@github.com"}],"tags":["nvd","cve.org"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-09-17T14:55:10.455520Z"},"cvssSource":"cna","ingestedAt":"2026-09-16T21:05:36.880Z","epss":0.00394,"epssPercentile":0.33393,"slug":"CVE-2026-62997","body":"## Overview\n\nKedro-Datasets provides data connectors for Kedro. From version 5.0.0 until 9.5.0, kedro_datasets_experimental.pytorch.PyTorchDataset in kedro-datasets loads .pt model files with torch.load without enforcing weights_only=True, and user-supplied load_args are silently dropped. On PyTorch versions earlier than 2.6, a malicious pickle-backed model from an attacker-influenced shared registry, downloaded checkpoint, or partitioned external source can execute arbitrary code when a Kedro pipeline loads it. The issue affects only the opt-in kedro_datasets_experimental component and does not affect users who load only trusted files. This issue is fixed in version 9.5.0.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":42,"depthScoreParts":{"impact":42.4,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}