~ / search / GHSA-rm69-wvpv-r2w7

GHSA-rm69-wvpv-r2w7

Kedro allows Remote Code Execution by Pulling Micro Packages

Source: GitHub Advisory Database (reviewed) High CVE-2024-12215

Packages

EcosystemPackageAffectedFixed in
PyPI kedro <= 0.19.8 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

In kedro-org/kedro version 0.19.8, the `pull_package()` API function allows users to download and extract micro packages from the Internet. However, the function `project_wheel_metadata()` within the code path can execute the `setup.py` file inside the tar file, leading to remote code execution (RCE) by running arbitrary commands on the victim's machine.

References

External links from the advisory. They lead to third-party sites.