Kedro Plugins
Monthly
Unsafe deserialization in the opt-in kedro_datasets_experimental.pytorch.PyTorchDataset connector (kedro-datasets versions 5.0.0 through <9.5.0) allows code execution during pipeline load, because the dataset calls torch.load on .pt files without enforcing weights_only=True and silently drops user-supplied load_args, so even an explicit weights_only override never reached PyTorch. Exploitation requires a PyTorch runtime earlier than 2.6 (where weights_only defaults to False) plus a victim pipeline that loads a checkpoint obtained from an attacker-influenced shared model registry, downloaded checkpoint, or partitioned external dataset; unauthenticated remote attackers can plant the payload but must wait for that user interaction, and pipelines loading only trusted files are unaffected. There is no public exploit identified at time of analysis and no confirmed active exploitation; the vendor-released patch is version 9.5.0, which enforces weights_only=True by default and correctly forwards load_args and save_args.
Unsafe deserialization in the opt-in kedro_datasets_experimental.pytorch.PyTorchDataset connector (kedro-datasets versions 5.0.0 through <9.5.0) allows code execution during pipeline load, because the dataset calls torch.load on .pt files without enforcing weights_only=True and silently drops user-supplied load_args, so even an explicit weights_only override never reached PyTorch. Exploitation requires a PyTorch runtime earlier than 2.6 (where weights_only defaults to False) plus a victim pipeline that loads a checkpoint obtained from an attacker-influenced shared model registry, downloaded checkpoint, or partitioned external dataset; unauthenticated remote attackers can plant the payload but must wait for that user interaction, and pipelines loading only trusted files are unaffected. There is no public exploit identified at time of analysis and no confirmed active exploitation; the vendor-released patch is version 9.5.0, which enforces weights_only=True by default and correctly forwards load_args and save_args.