Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

PyPI package

torchgeo

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.1PyPIAmendedPublished

    TorchGeo Remote Code Execution Vulnerability

    CVE-2024-49048 · GHSA-ghq9-vc6f-8qjf

    Affected
    • PyPI torchgeo >= 0.4, <= 0.6.0
    Fixed in
    0.6.1· Vendor fix available
    Issue
    Impact TorchGeo 0.4–0.6.0 used an eval statement in its model weight API that could allow an unauthenticated, remote attacker to execute arbitrary commands. All platforms that expose torchgeo.models.getweight() or torchgeo.trainers as an external API could be affected. Patches The eval statement was replaced with a fixed enum lookup, preventing arbitrary code injection. All users are encouraged to upgrade to TorchGeo 0.6.1 or newer. Workarounds In unpatched versions, input validation and sanitization can be used to avoid this vulnerability. References Bug history Introduced: https://github.com/torchgeo/torchgeo/pull/917 Patched: https://github.com/torchgeo/torchgeo/pull/2323 Released: v0.6.1

    Recommended action: Upgrade to 0.6.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →