Ultralytics torch_safe_load command injection enables remote code execution
Original title: ZDI-26-814: (0Day) Ultralytics torch_safe_load Command Injection Remote Code Execution Vulnerability
ZDI-26-814 is an unpatched CVSS 7.8 flaw that needs a user to open a file or visit a page.
ZDI published ZDI-26-814, labeled a zero-day, in Ultralytics torch_safe_load. The command-injection bug lets remote attackers execute arbitrary code when a user opens a malicious file or visits a malicious page. The assigned CVSS rating is 7.8. No affected range or fixed version is given.
Unconfirmed: Versions, remediation, and real-world exploitation are not stated.
- The advisory identifier is ZDI-26-814.
- The named component is torch_safe_load.
- The flaw class is command injection leading to remote code execution.
- User interaction is required and CVSS is 7.8.
Impact: remote arbitrary code execution after user interaction
| Product | Affected |
|---|---|
| Ultralytics | — |
- Vendors
- Ultralytics
- Organizations
- Zero Day Initiative
From the original article
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.