KedroGHSA-rm69-wvpv-r2w7

Kedro allows Remote Code Execution by Pulling Micro Packages

CVE-2024-12215 · Published Mar 20, 2025 · updated Jul 7, 2026

High8.8

No fix yet

In kedro-org/kedro version 0.19.8, the pull_package() API function allows users to download and extract micro packages from the Internet. However, the function project_wheel_metadata() within the code path can execute the setup.py file inside the tar file, leading to remote code execution (RCE) by running arbitrary commands on the victim's machine.

Affected versions

Package	Affected	Fixed in
kedro PyPI	<= 0.19.8	No fix yet

Details and references

CVSS 3.0: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Severity from: GitHub (reviewed advisory)
Weakness: CWE-20, CWE-829, CWE-94
Also known as: CVE-2024-12215, PYSEC-2026-1485

More Kedro advisories

All Kedro

Critical 9.8Apr 3

Kedro has Arbitrary Code Execution via Malicious Logging ConfigurationCVE-2026-35171fixed in 1.3.0 High 7.1Apr 3

Kedro: Path Traversal in versioned dataset loading via unsanitized version stringCVE-2026-35167fixed in 1.3.0 Critical 9.8Mar 20, 2025

Kedro deserialization vulnerabilityCVE-2024-9701fixed in 0.19.9