https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T13:57:25.356481+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-254981 EUVD-2026-254981 2026-10-04T13:57:25.359269+00:00 EUVD-2026-254981 https://cve.radiocsirt.org/vuln/fkie_cve-2024-12215 fkie_cve-2024-12215 2026-10-04T13:57:25.359301+00:00

In kedro-org/kedro version 0.19.8, the `pull_package()` API function allows users to download and extract micro packages from the Internet. However, the function `project_wheel_metadata()` within the code path can execute the `setup.py` file inside the tar file, leading to remote code execution (RCE) by running arbitrary commands on the victim's machine.

 https://cve.radiocsirt.org/vuln/ghsa-rm69-wvpv-r2w7 GHSA-rm69-wvpv-r2w7 — Kedro allows Remote Code Execution by Pulling Micro Packages 2026-10-04T13:57:25.359334+00:00

Affected: PyPI: kedro

In kedro-org/kedro version 0.19.8, the `pull_package()` API function allows users to download and extract micro packages from the Internet. However, the function `project_wheel_metadata()` within the code path can execute the `setup.py` file inside the tar file, leading to remote code execution (RCE) by running arbitrary commands on the victim's machine.

 https://cve.radiocsirt.org/vuln/pysec-2026-1485 PYSEC-2026-1485 — Kedro allows Remote Code Execution by Pulling Micro Packages 2026-10-04T13:57:25.359359+00:00

Affected: PyPI: kedro

In kedro-org/kedro version 0.19.8, the `pull_package()` API function allows users to download and extract micro packages from the Internet. However, the function `project_wheel_metadata()` within the code path can execute the `setup.py` file inside the tar file, leading to remote code execution (RCE) by running arbitrary commands on the victim's machine.