CVE-2024-9701: Kedro deserialization vulnerability
A Remote Code Execution (RCE) vulnerability has been identified in the Kedro ShelveStore class (version 0.19.8). This vulnerability allows an attacker to execute arbitrary Python code via deserialization of malicious payloads, potentially leading to a full system compromise. The ShelveStore class uses Python's shelve module to manage session data, which relies on pickle for serialization.
Published Mar 20, 2025 · Updated Jul 6, 2026
Affected packages
kedro
- Ecosystem
- PyPI
- Affected
- < 0.19.9
- Fixed in
- 0.19.9
- Check
pip show kedro
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
A Remote Code Execution (RCE) vulnerability has been identified in the Kedro ShelveStore class (version 0.19.8). This vulnerability allows an attacker to execute arbitrary Python code via deserialization of malicious payloads, potentially leading to a full system compromise. The ShelveStore class uses Python's shelve module to manage session data, which relies on pickle for serialization. Crafting a malicious payload and storing it in the shelve file can lead to RCE when the payload is deserialized.
References
- https://nvd.nist.gov/vuln/detail/CVE-2024-9701
- https://huntr.com/bounties/96c77fef-93b2-4d4d-8cbe-57a718d8eea5
- https://github.com/kedro-org/kedro/commit/66e5e074b2789469550370f370c8b486f638d975
- https://github.com/pypa/advisory-database/tree/main/vulns/kedro/PYSEC-2026-367.yaml
- https://github.com/advisories/GHSA-747f-ww56-4q4h
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology