Executive brief
Kedro, a Python framework for creating reproducible data pipelines, contains a critical security flaw in its session management component. An attacker can exploit this to run unauthorized commands on the server hosting the application. This could lead to a complete system takeover, theft of sensitive data, or disruption of data processing operations.
Technical details
A deserialization vulnerability exists in the Kedro ShelveStore class due to its reliance on Python's 'shelve' module, which uses the 'pickle' library for data serialization. Because pickle is inherently insecure when processing untrusted data, an attacker can craft a malicious payload that, when stored and subsequently deserialized by the ShelveStore class, executes arbitrary Python code. The vulnerability is reachable over the network without authentication if the application exposes session management functionality. The issue was addressed in version 0.19.9 by removing the vulnerable ShelveStore class.
Affected products
- kedro-org kedro < 0.19.9
Timeline
- 2025-03-20: disclosed
- 2025-03-20: advisory
- 2025-03-21: other: GitHub advisory reviewed