In short
- CVE-2024-12215 is a HIGH (CVSS 8.8) vulnerability affecting kedro.
- Chance of exploitation in the next 30 days (EPSS): 1.1%, higher than 65.0% of all vulnerabilities.
- No patched version is listed yet: follow the vendor's advisory in References.
| Package | Affected versions | Patched versions |
|---|
| kedro PyPI | ≤ 0.19.8
| No fix yet |
Description
In kedro-org/kedro version 0.19.8, the pull_package() API function allows users to download and extract micro packages from the Internet. However, the function project_wheel_metadata() within the code path can execute the setup.py file inside the tar file, leading to remote code execution (RCE) by running arbitrary commands on the victim's machine.
NVD description
In kedro-org/kedro version 0.19.8, the `pull_package()` API function allows users to download and extract micro packages from the Internet. However, the function `project_wheel_metadata()` within the code path can execute the `setup.py` file inside the tar file, leading to remote code execution (RCE) by running arbitrary commands on the victim's machine.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free