AIKIDO-2025-10888
ultralytics is vulnerable to Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
60
Medium Risk
This Affects:
ultralyticsTL;DR
Affected versions of this package are vulnerable to arbitrary code execution due to the unsafe use of eval() for parsing user-supplied values. This has been fixed by replacing eval() with ast.literal_eval() throughout the codebase, ensuring safe and predictable parsing of configuration inputs. The update prevents code injection risks, improves input handling in functions like smart_value(), and enhances overall security and reliability.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
ultralytics is vulnerable to Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in versions 8.0.141 - 8.3.233.
How to fix this
Upgrade the ultralytics library to the patch version.
Get Secure Now
Secure your code, cloud, and runtime environments in one central system. Find and fix vulnerabilities automatically.
No credit card required | Scan results in 32secs.
SOC 2Compliant
ISO 27001Compliant