CVE-2024-6345 - CVE House
Back to Database
Status published High CVE-2024-6345

Remote Code Execution in pypa/setuptools

Vulnerability Description

A vulnerability in the package_index module of pypa/setuptools versions up to 69.1.1 allows for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system. The issue is fixed in version 70.0.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-6345

Credits & Attribution

No credits recorded in the NVD database.

References

More from pypa

View All →
CVE-2025-47273
setuptools has a path traversal vulnerability in PackageIndex.download that leads to Arbitrary File Write
High 7.7
CVE-2022-21668
Pipenv's requirements.txt parsing allows malicious index url in comments
High 8
CVE-2019-20916
The pip package before 19.2 for Python allows Directory Traversal...
High 7.5
CVE-2018-20225
An issue was discovered in pip (all versions) because it...
Unknown 0
CVE-2014-8991
pip 1.3 through 1.5.6 allows local users to cause a...
Low 2.1

Affected Vendor

Affected Software

pypa/setuptools
Vulnerable Versions:
unspecified

Timeline

Official Publish: July 15th, 2024
Last Modified: November 4th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-94

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1059 Command and Scripting Interpreter
Execution
T1505.003 Web Shell
Persistence
T1105 Ingress Tool Transfer
Command and Control
T1565.002 Stored Data Manipulation
Impact