Summary

In this post, we will understand about the exploit and the root cause of a command injection vulnerability found in the data lake component of Kaggle, while loading an external dataset. We also analyze the patch and understand how it all got fixed.

Script link

Deep Lake Kaggle dataset command injection | JFSA-2024-001035320 - JFrog Security Research

CVE-2024-6507, HIGH, Command injection when ingesting a remote Kaggle dataset due to a lack of input sanitization in the ingest_kaggle() API

Description