| Package | Affected versions | Patched versions |
|---|---|---|
| torchgeo | ≥ 0.4, < 0.6.1< 0.6.1 | 0.6.1 |
| torchgeo | < 0.6.1 | 0.6.1 |
TorchGeo 0.4–0.6.0 used an eval statement in its model weight API that could allow an unauthenticated, remote attacker to execute arbitrary commands. All platforms that expose torchgeo.models.get_weight() or torchgeo.trainers as an external API could be affected.
The eval statement was replaced with a fixed enum lookup, preventing arbitrary code injection. All users are encouraged to upgrade to TorchGeo 0.6.1 or newer.
In unpatched versions, input validation and sanitization can be used to avoid this vulnerability.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free