Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

kedro-org/kedro

              main @ 5337773
            

Fixes

CVEs

CRITICAL

Peak severity

50.0%

Coverage

Highlights

Path Traversal: 4 prior fixes. Scrutinize any change in this area.

kedro.framework.session.shelvestore: most-fixed (1 issue). Treat as high-risk during review.

7 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Remote Code Execution: Unsafe handling of user-controlled logging configuration structures via dictConfig allowed remote code execution via arbitrary object instantiation using the '()' key. Future configurations must undergo strict recursive validation.

Code Execution: Dynamic loading of arbitrary python objects through the 'load_obj' sink allows arbitrary code execution. Loading must be protected by strict allowlists and type assertions verifying inheritance.

Path Traversal: Insecure concatenation of version strings in dataset resolution (such as 'self._filepath / version') allows attackers to escape the intended storage directory. Input versions must be strictly validated to block path separators.