CVE-2024-12215CWE-94

Remote Code Execution in kedro-org/kedro

High · published March 20, 2025

CVSS v3.0
8.8
EPSS
1%
Percentile
64.7
In the wild
Unconfirmed
What it is

In kedro-org/kedro version 0.19.8, the `pull_package()` API function allows users to download and extract micro packages from the Internet. However, the function `project_wheel_metadata()` within the code path can execute the `setup.py` file inside the tar file, leading to remote code execution (RCE) by running arbitrary commands on the victim's machine.

The record
Technical detail
CVSS v3.0
8.8 · HIGH
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01077 · 64.7th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2025-03-20T10:11Z
EPSS history
Timeline
  • 20 MAR 10:11Z
    Remote Code Execution in kedro-org/kedro
    cvelistv5