kedro-org — Vulnerabilities & Security Advisories 5

Kedro-org is an open-source data pipeline framework enabling Python-based ML and data science workflows. Historically, it has faced vulnerabilities including remote code execution (RCE) in template rendering, cross-site scripting (XSS) in web UI components, and privilege escalation through improper access controls. The project maintains a moderate security posture with five disclosed CVEs, primarily addressing input validation flaws and insecure default configurations. While no major incidents have been widely reported, the project's growing adoption has led to increased scrutiny of its security practices, particularly around template processing and web interface components.