Description
A Remote Code Execution (RCE) vulnerability has been identified in the Kedro ShelveStore class (version 0.19.8). This vulnerability allows an attacker to execute arbitrary Python code via deserialization of malicious payloads, potentially leading to a full system compromise. The ShelveStore class uses Python's shelve module to manage session data, which relies on pickle for serialization. Crafting a malicious payload and storing it in the shelve file can lead to RCE when the payload is deserialized.
INFO
Published Date :
2025-03-20T10:10:05.630Z
Last Modified :
2025-03-20T18:31:32.507Z
Source :
@huntr_ai
AFFECTED PRODUCTS
The following products are affected by CVE-2024-9701 vulnerability.
No data.
REFERENCES
Here, you will find a curated list of external links that provide in-depth information to CVE-2024-9701.
