GHSA-747f-ww56-4q4h · Severity: critical · Ecosystem: pip — Kedro deserialization vulnerability
A Remote Code Execution (RCE) vulnerability has been identified in the Kedro ShelveStore class (version 0.19.8). This vulnerability allows an attacker to execute arbitrary Python code via deserialization of malicious payloads, potentially leading to a full system compromise. The ShelveStore class uses Python's shelve module to manage session data, which relies on pickle for serialization. Crafting a malicious payload and storing it in the shelve file can lead to RCE when the payload is deserialized.
Conclusion & alert: CVE-2024-9701 is rated Moderate Risk (54.1/100): CVSS Critical severity, with medium exploitation likelihood (EPSS 0.96%). Mandatory action: Review affected assets and schedule remediation.
Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.
EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).
| # | Date | Old EPSS score | New EPSS score | Delta (New - Old) |
|---|---|---|---|---|
| 1 | 2026-06-15 | 6.14% | 0.96% | -5.18% |
| 2 | 2026-04-30 | 7.62% | 6.14% | -1.48% |
| 3 | 2026-04-29 | — | 7.62% | — |
Full EPSS history (19 records total)
CVSS metrics for this CVE.
| Base score | Version | Severity | Vector | Exploitability | Impact | Score source |
|---|---|---|---|---|---|---|
| 9.8 | 3.0 | CRITICAL |
|
3.9 | 5.9 | [email protected] |
GHSA-747f-ww56-4q4h · Severity: critical · Ecosystem: pip — Kedro deserialization vulnerability
| Vendor | Product | Version | Raw CPE |
|---|---|---|---|
| No affected products in dataset. | |||