CVE-2024-49048
TorchGeo Remote Code Execution Vulnerability
TorchGeo Remote Code Execution Vulnerability
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
TorchGeo Remote Code Execution Vulnerability
TorchGeo Remote Code Execution Vulnerability
- Record
CVE-2024-49048- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C - Weakness
- CWE-94
- Updated
- 2026-11-02
EUVDEUVD-2024-0217
TorchGeo Remote Code Execution Vulnerability
- Record
EUVD-2024-0217- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-g5vp-j278-8pjh
Duplicate Advisory: TorchGeo Remote Code Execution Vulnerability
Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-ghq9-vc6f-8qjf. This link is maintained to preserve external references.
Original Description
TorchGeo Remote Code Execution Vulnerability
- Record
GHSA-g5vp-j278-8pjh- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-ghq9-vc6f-8qjf
TorchGeo Remote Code Execution Vulnerability
Impact
TorchGeo 0.4–0.6.0 used an eval statement in its model weight API that could allow an unauthenticated, remote attacker to execute arbitrary commands. All platforms that expose torchgeo.models.get_weight() or torchgeo.trainers as an external API could be affected.
Patches
The eval statement was replaced with a fixed enum lookup, preventing arbitrary code injection. All users are encouraged to upgrade to TorchGeo 0.6.1 or newer.
Workarounds
In unpatched versions, input validation and sanitization can be used to avoid this vulnerability.
References
Bug history
- Introduced: https://github.com/torchgeo/torchgeo/pull/917
- Patched: https://github.com/torchgeo/torchgeo/pull/2323
- Released: v0.6.1
- Record
GHSA-ghq9-vc6f-8qjf- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-94, CWE-95
- Updated
- 2026-11-02
NVD
TorchGeo Remote Code Execution Vulnerability
- Record
CVE-2024-49048- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-02
OSV
TorchGeo Remote Code Execution Vulnerability
- Record
CVE-2024-49048- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-g5vp-j278-8pjh
Duplicate Advisory: TorchGeo Remote Code Execution Vulnerability
Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-ghq9-vc6f-8qjf. This link is maintained to preserve external references.
Original Description
TorchGeo Remote Code Execution Vulnerability
- Record
GHSA-g5vp-j278-8pjh- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-02
OSVGHSA-ghq9-vc6f-8qjf
TorchGeo Remote Code Execution Vulnerability
Impact
TorchGeo 0.4–0.6.0 used an eval statement in its model weight API that could allow an unauthenticated, remote attacker to execute arbitrary commands. All platforms that expose torchgeo.models.get_weight() or torchgeo.trainers as an external API could be affected.
Patches
The eval statement was replaced with a fixed enum lookup, preventing arbitrary code injection. All users are encouraged to upgrade to TorchGeo 0.6.1 or newer.
Workarounds
In unpatched versions, input validation and sanitization can be used to avoid this vulnerability.
References
Bug history
- Introduced: https://github.com/torchgeo/torchgeo/pull/917
- Patched: https://github.com/torchgeo/torchgeo/pull/2323
- Released: v0.6.1
- Record
GHSA-ghq9-vc6f-8qjf- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-94, CWE-95
- Updated
- 2026-11-02
OSVPYSEC-2024-204
TorchGeo Remote Code Execution Vulnerability
- Record
PYSEC-2024-204- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-49048 is a high vulnerability (CVSS 8.1) in Microsoft Torchgeo, published November 12, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.24%, the 69th percentile. Fixed in torchgeo 0.6.1.
References
msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49048
nvd.nist.gov/vuln/detail/CVE-2024-49048
github.com/microsoft/torchgeo/pull/2323
Show 7 moreShow less