Vulnerability · Published Mar 20, 2025 · Assigned by @huntr_ai
CVE-2024-9701Remote Code Execution in kedro-org/kedro
Critical 9.8
In plain English
A critical-severity unsafe deserialization in kedro-org/kedro from kedro-org. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 67% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A Remote Code Execution (RCE) vulnerability has been identified in the Kedro ShelveStore class (version 0.19.8). This vulnerability allows an attacker to execute arbitrary Python code via deserialization of malicious payloads, potentially leading to a full system compromise. The ShelveStore class uses Python's shelve module to manage session data, which relies on pickle for serialization. Crafting a malicious payload and storing it in the shelve file can lead to RCE when the payload is deserialized.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | kedro | 0.19.9 | GHSA-747f-ww56-4q4h |
| PyPI | kedro | 0.19.9 | PYSEC-2026-367 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| kedro-org | kedro-org/kedro | unspecified – before 0.19.9 |
Weakness: CWE-502 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H