CVE-2024-12215 — Remote Code Execution in kedro-org/kedro
In kedro-org/kedro version 0.19.8, the `pull_package()` API function allows users to download and extract micro packages from the Internet. However, the function `project_wheel_…
Published: 2025-03-20 · CVSS: 8.8 · CVSS 3.0
In kedro-org/kedro version 0.19.8, the `pull_package()` API function allows users to download and extract micro packages from the Internet. However, the function `project_wheel_metadata()` within the code path can execute the `setup.py` file inside the tar file, leading to remote code execution (RCE) by running arbitrary commands on the victim's machine.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7