CVE-2024-12215

Summary

CVE-2024-12215 is a remote code execution (RCE) vulnerability affecting version 0.19.8 of kedro-org/kedro. The `pull_package()` API function enables users to download and extract micro packages from the internet. However, the `project_wheel_metadata()` function within the code path can execute the `setup.py` file contained in the tar file, allowing an attacker to run arbitrary commands on the victim's machine. Successful exploitation of this vulnerability could lead to significant security implications. Users are urged to update to a patched version as soon as possible.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.