Kedro-Datasets PyTorchDataset: torch.load without weights_only executes code from .pt files

Impact

PyTorchDataset loads .pt model files through torch.load() without forcing weights_only=True, and silently drops user-supplied load_args so an operator cannot set it themselves. On PyTorch below 2.6 the default pickle path runs arbitrary code at load time, so a model pulled from a shared registry, a downloaded checkpoint or a partitioned external source executes as the pipeline process the moment the pipeline reads it. On a GPU fleet that process is usually a training or batch job with fleet credentials and dataset mounts, so a poisoned checkpoint becomes code execution inside the cluster rather than a bad model. Affects versions 5.0.0 up to 9.5.0 and only the opt-in kedro_datasets_experimental component; deployments that load only trusted files are not affected.

Who can reach it

Anyone who can influence the contents of a .pt file a Kedro pipeline loads - a shared model registry, an external partitioned source, a downloaded checkpoint. No authentication to the Kedro deployment is needed; the pipeline run itself is the trigger.

What to do

Upgrade kedro-datasets to 9.5.0 or later and restart the pipeline workers that use it. Where an upgrade cannot land immediately, move to PyTorch 2.6 or newer (which defaults to weights_only=True) and restrict the pipeline to checkpoint sources you control.

References

Related entries

• SitemapLoader: nested sitemap entries skip restrict_to_same_domain, giving readable SSRFCVE-2026-72848 · langchain-community SitemapLoader (nested sitemap index entries)High
• JupyterLab: missing await skips extension allowlist check for direct PyPIExtensionManager callersCVE-2026-73626 · JupyterLab PyPIExtensionManager.install() (extension allowlist/blocklist enforcement)High
• Headroom LLM proxy: client-chosen upstream base URL enables SSRF and leaks the Authorization headerCVE-2026-77775 · Headroom LLM proxy (x-headroom-base-url upstream selection)High
• JupyterLab: XSS via untrusted notebook contentCVE-2024-43805 · JupyterLabHigh
• ONNX: Directory traversal via `external_data` field in the tensor protoCVE-2022-25882 · ONNXHigh
• Dagster (webserver): Directory traversalCVE-2023-51232 · Dagster (webserver)High