~ / search / GHSA-m724-hqmc-ggpx

GHSA-m724-hqmc-ggpx

GluonCV Arbitrary File Write via TarSlip

Source: GitHub Advisory Database (reviewed) High CVE-2024-12216

Packages

EcosystemPackageAffectedFixed in
PyPI gluoncv <= 0.10.0 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

A vulnerability in the `ImageClassificationDataset.from_csv()` API of the `dmlc/gluon-cv` repository, version 0.10.0, allows for arbitrary file write. The function downloads and extracts `tar.gz` files from URLs without proper sanitization, making it susceptible to a TarSlip vulnerability. Attackers can exploit this by crafting malicious tar files that, when extracted, can overwrite files on the victim's system via path traversal or faked symlinks.

References

External links from the advisory. They lead to third-party sites.