HIGH8.8

PYSEC-2026-1485

Kedro allows Remote Code Execution by Pulling Micro Packages

Details

In kedro-org/kedro version 0.19.8, the `pull_package()` API function allows users to download and extract micro packages from the Internet. However, the function `project_wheel_metadata()` within the code path can execute the `setup.py` file inside the tar file, leading to remote code execution (RCE) by running arbitrary commands on the victim's machine.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/kedro

Introduced in: 0

No fixed version published yet for kedro (pip). Pin to a known-safe version or switch to an alternative.

References

https://nvd.nist.gov/vuln/detail/CVE-2024-12215[ADVISORY]
https://github.com/kedro-org/kedro[PACKAGE]
https://huntr.com/bounties/fad27503-97a4-4933-91d4-96223b8c54d8[WEB]
https://pypi.org/project/kedro[PACKAGE]
https://github.com/advisories/GHSA-rm69-wvpv-r2w7[ADVISORY]