Security Advisory

CVE-2024-12215

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2025-03-20 10:11:39

Last updated 2025-10-15 12:49:30

Assigner @huntr_ai

CVSS score 8.8

State PUBLISHED

Description

In kedro-org/kedro version 0.19.8, the `pull_package()` API function allows users to download and extract micro packages from the Internet. However, the function `project_wheel_metadata()` within the code path can execute the `setup.py` file inside the tar file, leading to remote code execution (RCE) by running arbitrary commands on the victim's machine.

← Browse all CVEs View on cve.org ↗