Description
In kedro-org/kedro version 0.19.8, the `pull_package()` API function allows users to download and extract micro packages from the Internet. However, the function `project_wheel_metadata()` within the code path can execute the `setup.py` file inside the tar file, leading to remote code execution (RCE) by running arbitrary commands on the victim's machine.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| kedro-org | kedro-org/kedro | unspecified – ≤ latest | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | kedro | <= 0.19.8 | — | GHSA-rm69-wvpv-r2w7 |