AIKIDO-2025-10888
ultralytics is vulnerable to Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
60
Medium Risk
This Affects:
ultralyticsTL;DR
Affected versions of this package are vulnerable to arbitrary code execution due to the unsafe use of eval() for parsing user-supplied values. This has been fixed by replacing eval() with ast.literal_eval() throughout the codebase, ensuring safe and predictable parsing of configuration inputs. The update prevents code injection risks, improves input handling in functions like smart_value(), and enhances overall security and reliability.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
ultralytics is vulnerable to Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in versions 8.0.141 - 8.3.233.
How to fix this
Upgrade the ultralytics library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant