PyPi: Kedro

CVE-2024-12215

Safety vulnerability ID: 76273

This vulnerability was reviewed by experts

The information on this page was manually curated by our Cybersecurity Intelligence Team.

Created at Mar 20, 2025 Updated at Mar 28, 2025

Scan your Python projects for vulnerabilities →

Advisory

In kedro-org/kedro version 0.19.8, the pull_package() API function allows users to download and extract micro packages from the Internet. However, the function project_wheel_metadata() within the code path can execute the setup.py file inside the tar file, leading to remote code execution (RCE) by running arbitrary commands on the victim's machine.

Affected package

kedro

Latest version: 0.19.12

Kedro helps you build production-ready data and analytics pipelines

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

Use this package?

Scan your Python project for dependency vulnerabilities in two minutes

Scan your application