CVE-2024-6345 is a high-severity vulnerability in the setuptools package_index module used by PyTorch versions 2.2.0 up to but not including 2.4.1. It allows remote code execution via command injection through download functions that handle package URLs. This flaw is fixed in setuptools version 70.0 and PyTorch 2.4.1.