CVE-2026-62997

Kedro-Datasets' opt-in experimental PyTorch connector (kedro_datasets_experimental.pytorch.PyTorchDataset) loads .pt model files via torch.load without enforcing weights_only=True, and user-supplied load_args are silently dropped, so safe loading cannot be enabled through configuration (CWE-502). It is triggered when a Kedro pipeline loads a pickle-backed .pt model from an attacker-influenced source, such as a shared registry, a downloaded checkpoint, or a partitioned external data source, on PyTorch versions earlier than 2.6. An attacker gains arbitrary code execution on the host running the pipeline. Only users of the opt-in experimental component who load untrusted files are affected; pipelines loading only trusted files are not impacted. No public proof-of-concept is known, it is not in CISA KEV, and no exploitation has been reported; the flaw is fixed in version 9.5.0.

What to do: Upgrade kedro-datasets to 9.5.0 or later, or upgrade PyTorch to 2.6+ so torch.load defaults to weights_only=True. Audit pipelines for use of kedro_datasets_experimental.pytorch.PyTorchDataset and ensure any .pt files it loads come only from trusted sources (shared registries, downloaded checkpoints, and partitioned external stores are the risky paths). Note that supplying weights_only=True via load_args is not a reliable mitigation because load_args are silently dropped in affected versions.