CVE-2026-62997 Kedro-Datasets: Remote code execution in experimental `PyTorchDataset` via unsafe `torch.load`
Attackers can execute arbitrary code via malicious PyTorch model files in the experimental Kedro-Datasets component if users load untrusted data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-62997?
CVE-2026-62997 is a high-severity unsafe deserialization vulnerability in kedro-org kedro-plugins, published on 16 Sep 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Kedro-Datasets provides data connectors for Kedro. From version 5.0.0 until 9.5.0, kedro_datasets_experimental.pytorch.PyTorchDataset in kedro-datasets loads .pt model files with torch.load without enforcing weights_only=True, and user-supplied load_args are silently dropped. On PyTorch versions earlier than 2.6, a malicious pickle-backed model from an attacker-influenced shared registry, downloaded checkpoint, or partitioned external source can execute arbitrary code when a Kedro pipeline loads it. The issue affects only the opt-in kedro_datasets_experimental component and does not affect users who load only trusted files. This issue is fixed in version 9.5.0.
Weakness: CWE-502
Which versions are affected by CVE-2026-62997?
How do I fix CVE-2026-62997?
No fix has been published for CVE-2026-62997 yet. Limit exposure of the affected software until one is available.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2026-62997 being exploited?
There is no known exploitation of CVE-2026-62997 in the wild and no public exploit code.
Sources
Also known as GHSA-f9q4-h45w-jrrq.