Staging Environment: Content and features may be unstable or change without notice.

Advisory Weakness Curation

CVE-2024-12215

Progress 0 / 0

Advisory Summaries

github_osv/GHSA-rm69-wvpv-r2w7

Kedro allows Remote Code Execution by Pulling Micro Packages In kedro-org/kedro version 0.19.8, the `pull_package()` API function allows users to download and extract micro packages from the Internet. However, the function `project_wheel_metadata()` within the code path can execute the `setup.py` file inside the tar file, leading to remote code execution (RCE) by running arbitrary commands on the victim's machine.

gitlab/pypi/kedro/CVE-2024-12215

Kedro allows Remote Code Execution by Pulling Micro Packages In kedro-org/kedro version 0.19.8, the `pull_package()` API function allows users to download and extract micro packages from the Internet. However, the function `project_wheel_metadata()` within the code path can execute the `setup.py` file inside the tar file, leading to remote code execution (RCE) by running arbitrary commands on the victim's machine.