GitHub Advisoryadvisory · PyPI

GHSA-rm69-wvpv-r2w7 Kedro allows Remote Code Execution by Pulling Micro Packages

HIGH Published 2025-03-20 Modified 2025-03-21 Official page ↗
Aliases
CVE-2024-12215
Ecosystem
PyPI
Packages
kedro
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-20, CWE-829, CWE-94
Reviewed
2025-03-21

Affected packages

• PyPI kedro: <= 0.19.8 (no fix yet)

Description

In kedro-org/kedro version 0.19.8, the `pull_package()` API function allows users to download and extract micro packages from the Internet. However, the function `project_wheel_metadata()` within the code path can execute the `setup.py` file inside the tar file, leading to remote code execution (RCE) by running arbitrary commands on the victim's machine.

Related

Alias · CVE (1)

  • CVE-2024-12215 In kedro-org/kedro version 0.19.8, the `pull_package()` API function allows users to download and extract micro packages from the Internet. vulnerability

Weakness · CWE (3)

  • CWE-20 Improper Input Validation weakness
  • CWE-829 Inclusion of Functionality from Untrusted Control Sphere weakness
  • CWE-94 Improper Control of Generation of Code weakness

References