CVE-2026-62997: Kedro-Datasets: Remote code execution in experimental `PyTorchDataset` via unsafe `torch.load`
Kedro-Datasets provides data connectors for Kedro. From version 5.0.0 until 9.5.0, kedrodatasetsexperimental.pytorch.PyTorchDataset in kedro-datasets loads .pt model files with torch.load without enforcing weightsonly=True, and user-supplied loadargs are silently dropped. On PyTorch versions earlier than 2.6, a malicious pickle-backed model from an attacker-influenced shared registry, downloaded checkpoint, or partitioned external source can execute arbitrary code when a Kedro pipeline loads it. The issue affects only the opt-in kedrodatasetsexperimental component and does not affect users who load only trusted files. This issue is fixed in version 9.5.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
kedro-datasetsto a version that resolves this vulnerability.Fixed in 9.5.0
Event History
Frequently Asked Questions
Which deployments are exposed to exploitation?
Exposure is limited to deployments that opt into kedro_datasets_experimental.pytorch.PyTorchDataset, run a PyTorch version earlier than 2.6, and load attacker-influenced or otherwise untrusted .pt files. Pipelines that load only trusted files are not affected by this issue.
What must an attacker control to execute code?
An attacker needs to cause the pipeline to load a malicious pickle-backed model file. Examples include a model from an attacker-influenced shared registry, a downloaded checkpoint, or a partitioned external source.
Does supplying load_args mitigate the unsafe load behavior?
No. In the affected versions, user-supplied load_args are silently dropped, so they do not enforce weights_only=True during torch.load.
What is the remediation?
Upgrade kedro-datasets to version 9.5.0, which fixes the issue. Until upgrading, avoid loading untrusted .pt files through the experimental PyTorchDataset component.