{"cve":"CVE-2026-35171","nvd":{"published":"2026-04-06T18:16:43.373","modified":"2026-07-24T21:10:00.143","status":"Analyzed","description":"Kedro is a toolbox for production-ready data science. Prior to 1.3.0, Kedro allows the logging configuration file path to be set via the KEDRO_LOGGING_CONFIG environment variable and loads it without validation. The logging configuration schema supports the special () key, which enables arbitrary callable instantiation. An attacker can exploit this to execute arbitrary system commands during application startup. This is a critical remote code execution (RCE) vulnerability caused by unsafe use of logging.config.dictConfig() with user-controlled input. This vulnerability is fixed in 1.3.0.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8},"cwes":["CWE-94","CWE-502"],"references":["https://github.com/kedro-org/kedro/security/advisories/GHSA-9cqf-439c-j96r"],"products":["linuxfoundation:kedro"],"source":"nvd","synced_at":"2026-10-19T22:28:59.047572785+00:00"},"epss":{"cve":"CVE-2026-35171","score":0.00714,"percentile":0.53717,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-9cqf-439c-j96r","url":"https://osv.dev/vulnerability/GHSA-9cqf-439c-j96r","summary":"Kedro has Arbitrary Code Execution via Malicious Logging Configuration","modified":"2026-06-06T00:30:08.713758212Z","packages":[{"ecosystem":"PyPI","name":"kedro","purl":"pkg:pypi/kedro","ranges":["<1.3.0"],"fixed":["1.3.0"]}]},{"id":"PYSEC-2026-72","url":"https://osv.dev/vulnerability/PYSEC-2026-72","summary":"","modified":"2026-05-20T09:19:03.377815Z","packages":[{"ecosystem":"PyPI","name":"kedro","purl":"pkg:pypi/kedro","ranges":["<1.3.0"],"fixed":["1.3.0"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}