p PatchFirst

CVE-2026-35171

CVE-2026-35171 · Arbitrary Code Execution via Malicious Logging Configuration in Kedro

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Kedro is a toolbox for production-ready data science. Prior to 1.3.0, Kedro allows the logging configuration file path to be set via the KEDRO_LOGGING_CONFIG environment variable and loads it without validation. The logging configuration schema supports the special () key, which enables arbitrary callable instantiation. An attacker can exploit this to execute arbitrary system commands during application startup. This is a critical remote code execution (RCE) vulnerability caused by unsafe use of logging.config.dictConfig() with user-controlled input. This vulnerability is fixed in 1.3.0.

CVSS 9.8 · Critical · EPSS 0.7% · Fix available

Published
Updated

Stack: python

Affected products and versions

  • kedro

    Versions
    • < 1.3.0: Affected

    No fix published

  • kedro PyPI

    Versions
    • 0.14.0
    • 0.14.1
    • 0.14.2
    • 0.14.3
    • 0.15.0
    • 0.15.1
    • 0.15.2
    • 0.15.3
    • 0.15.4
    • 0.15.5
    • 0.15.6
    • 0.15.7
    • 0.15.8
    • 0.15.9
    • 0.16.0
    • 0.16.1
    • 0.16.2
    • 0.16.3
    • 0.16.4
    • 0.16.5
    • 0.16.6
    • 0.17.0
    • 0.17.1
    • 0.17.2
    • 0.17.3
    • 0.17.4
    • 0.17.5
    • 0.17.6
    • 0.17.7
    • 0.18.0
    • 0.18.1
    • 0.18.10
    • 0.18.11
    • 0.18.12
    • 0.18.13
    • 0.18.14
    • 0.18.2
    • 0.18.3
    • 0.18.4
    • 0.18.5
    • 0.18.6
    • 0.18.7
    • 0.18.8
    • 0.18.9
    • 0.19.0
    • 0.19.1
    • 0.19.10
    • 0.19.11
    • 0.19.12
    • 0.19.13
    • 0.19.14
    • 0.19.15
    • 0.19.2
    • 0.19.3
    • 0.19.4
    • 0.19.5
    • 0.19.6
    • 0.19.7
    • 0.19.8
    • 0.19.9
    • 1.0.0
    • 1.0.0rc1
    • 1.0.0rc2
    • 1.0.0rc3
    • 1.1.0
    • 1.1.1
    • 1.2.0
    Affected ranges
    • ECOSYSTEM: < 1.3.0

    Update to 1.3.0

Original sources

Check your server →