CVE-2024-12215

In kedro-org/kedro version 0.19.8, the "pullpackage" API function allows users to download and extract micro packages from the Internet. However, the function "projectwheelmetadata" within the code path can execute the "setup.py" file inside the tar file, leading to remote code execution RCE by...

CVE-2024-12215: Improper Control of Generation of Code

In kedro-org/kedro version 0.19.8, the pullpackage API function allows users to download and extract micro packages from the Internet. However, the function projectwheelmetadata within the code path can execute the setup.py file inside the tar file, leading to remote code execution RCE by running...