PYSEC-2024-154

A number of releases of ultralytics contained malicious crypto miner software.

8.7 HighFix available

Ultralytics has identified a supply chain attack affecting affecting multiple versions of the ultralytics package. The compromised versions contained unauthorized code that downloaded and executed cryptocurrency mining software when instantiating YOLO models. This code was injected into the PyPI release artifacts and was not present in the public GitHub repository.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: High
Availability: None

What each source reports

OSV Score used 8.7

A number of releases of ultralytics contained malicious crypto miner software.

Record: PYSEC-2024-154
CVSS 4.0: 8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
CVSS 3.1: 8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
Updated: 2026-11-02

Affected packages

Affected packages
Package	Affected	Fixed
`ultralytics` PyPI	8.3.41 up to 8.3.47, plus listed versions 8.3.428.3.438.3.448.3.458.3.46	8.3.47

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

PYSEC-2024-154 is a high vulnerability (CVSS 8.7) in ultralytics, published December 10, 2024. No source lists public exploit code. Fixed in ultralytics 8.3.47.