Ultralytics parse_model code injection allows remote code execution (ZDI-26-815)
Original title: ZDI-26-815: (0Day) Ultralytics parse_model Code Injection Remote Code Execution Vulnerability
ZDI rates the unpatched flaw 7.8; a victim must open a malicious file or visit a malicious page.
Trend Micro's Zero Day Initiative published ZDI-26-815, a zero-day code-injection flaw in Ultralytics parse_model. Remote attackers can run arbitrary code on affected installations if a user opens a malicious file or visits a malicious page. ZDI assigned CVSS 7.8. Affected versions and a fix are not stated.
Unconfirmed: The advisory does not state affected versions, a patch, or whether attacks are occurring.
- Advisory ID is ZDI-26-815 and the title marks it a zero-day.
- The vulnerable function named is parse_model.
- Exploitation requires the target to open a file or visit a page.
- ZDI's CVSS score is 7.8.
Impact: remote arbitrary code execution after user interaction
| Product | Affected |
|---|---|
| Ultralytics | — |
- Vendors
- Ultralytics
- Organizations
- Zero Day Initiative
From the original article
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.