Ultralytics vulnerabilities

A path traversal vulnerability in Ultralytics during Google Drive downloads could lead to remote code execution. The flaw results from lack of proper validation of a user-supplied path before use in file operations. User interaction is required (visiting a malicious page or opening a malicious file).

A code injection vulnerability in the parse_model function of Ultralytics could lead to remote code execution. The flaw results from lack of proper validation of a user-supplied string before using it to execute Python code. User interaction is required (visiting a malicious page or opening a malicious file).

A deserialization of untrusted data vulnerability in the load_dataset_cache_file function of Ultralytics could lead to remote code execution. The flaw results from lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. User interaction is required (visiting a malicious page or opening a malicious file).

A code injection vulnerability in the parse_model function of Ultralytics could lead to remote code execution. The flaw results from lack of proper validation of a user-supplied string before using it to execute Python code. User interaction is required (visiting a malicious page or opening a malicious file).

A command injection vulnerability in the torch_safe_load function of Ultralytics could lead to remote code execution. The flaw results from lack of proper validation of a user-supplied string before using it to execute a system call. User interaction is required (visiting a malicious page or opening a malicious file).

A code injection vulnerability in the check_det_dataset function of Ultralytics allows remote code execution. The flaw stems from lack of validation of a user-supplied string before using it to execute Python code. User interaction is required — the target must visit a malicious page or open a malicious file.

A deserialization of untrusted data vulnerability in the torch_load function of Ultralytics allows remote code execution. The flaw results from lack of validation of user-supplied data. User interaction is required — the target must visit a malicious page or open a malicious file.