CVE-2024-6345 is a high-severity vulnerability in the package_index module of pypa/setuptools versions up to 69.1.1. It allows remote code execution via command injection through download functions that handle package URLs. This flaw can be exploited if user-controlled inputs are passed to these functions, enabling arbitrary command execution on the affected system. The vulnerability is fixed in setuptools version 70.0. The affected product duplicity includes vulnerable versions prior to 0.7.09_1 and 2.2.3, with patches available.