CVE-2024-9701
published 2025-03-20CVE-2024-9701: A Remote Code Execution (RCE) vulnerability has been identified in the Kedro ShelveStore class (version 0.19.8). This vulnerability allows an attacker to…
PriorityP261critical9.8CVSS 3.0
AVNACLPRNUINSUCHIHAH
EPSS
1.03%
59.6th percentile
A Remote Code Execution (RCE) vulnerability has been identified in the Kedro ShelveStore class (version 0.19.8). This vulnerability allows an attacker to execute arbitrary Python code via deserialization of malicious payloads, potentially leading to a full system compromise. The ShelveStore class uses Python's shelve module to manage session data, which relies on pickle for serialization. Crafting a malicious payload and storing it in the shelve file can lead to RCE when the payload is deserialized.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| kedro-org | kedro | >= 0 < 0.19.9 | 0.19.9 |
| kedro-org | kedro-org_kedro | >= unspecified < 0.19.9 | 0.19.9 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Kedro deserialization vulnerability
osv·2025-03-20
CVE-2024-9701 [CRITICAL] Kedro deserialization vulnerability
Kedro deserialization vulnerability
A Remote Code Execution (RCE) vulnerability has been identified in the Kedro ShelveStore class (version 0.19.8). This vulnerability allows an attacker to execute arbitrary Python code via deserialization of malicious payloads, potentially leading to a full system compromise. The ShelveStore class uses Python's shelve module to manage session data, which relies on pickle for serialization. Crafting a malicious payload and storing it in the shelve file can lead to RCE when the payload is deserialized.
GHSA
Kedro deserialization vulnerability
ghsa·2025-03-20
CVE-2024-9701 [CRITICAL] CWE-502 Kedro deserialization vulnerability
Kedro deserialization vulnerability
A Remote Code Execution (RCE) vulnerability has been identified in the Kedro ShelveStore class (version 0.19.8). This vulnerability allows an attacker to execute arbitrary Python code via deserialization of malicious payloads, potentially leading to a full system compromise. The ShelveStore class uses Python's shelve module to manage session data, which relies on pickle for serialization. Crafting a malicious payload and storing it in the shelve file can lead to RCE when the payload is deserialized.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-03-20
Published