{"id":"CVE-2024-49048","aliases":["EUVD-2024-0217","GHSA-g5vp-j278-8pjh","GHSA-ghq9-vc6f-8qjf","PYSEC-2024-204"],"status":"published","title":"TorchGeo Remote Code Execution Vulnerability","description":"TorchGeo Remote Code Execution Vulnerability","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.01239,"percentile":0.69335,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-94","CWE-95"],"published":"2024-11-12T17:54:25Z","modified":"2026-10-24T10:30:15Z","fixes":[{"ecosystem":"PyPI","package":"torchgeo","fixed_in":["0.6.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"torchgeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.4"},{"last_affected":"0.6.0"},{"fixed":"0.6.1"}]}]},{"source":"osv","ecosystem":"PyPI","package":"torchgeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.4"},{"fixed":"0.6.1"}]}],"versions":["0.4.0","0.4.1","0.5.0","0.5.1","0.5.2","0.6.0"]},{"source":"osv","ecosystem":"PyPI","package":"torchgeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.1"}]}],"versions":["0.1.0","0.1.1","0.2.0","0.2.1","0.3.0","0.3.1","0.4.0","0.4.1","0.5.0","0.5.1","0.5.2","0.6.0"]}],"products":[{"vendor":"microsoft","product":"microsoft torchgeo"},{"vendor":"microsoft","product":"torchgeo"}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49048","tags":["vendor-advisory","Patch","Vendor Advisory","fix","web","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-49048","tags":["advisory"]},{"url":"https://github.com/microsoft/torchgeo/pull/2323","tags":["web"]},{"url":"https://github.com/microsoft/torchgeo/releases/tag/v0.6.1","tags":["web"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/torchgeo/PYSEC-2024-204.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-g5vp-j278-8pjh"},{"url":"https://github.com/torchgeo/torchgeo/security/advisories/GHSA-ghq9-vc6f-8qjf","tags":["web"]},{"url":"https://github.com/torchgeo/torchgeo/pull/2323","tags":["web"]},{"url":"https://github.com/torchgeo/torchgeo/pull/917","tags":["web"]},{"url":"https://github.com/torchgeo/torchgeo/commit/1a980788cb7089a1115f3b786c7daa9dd47d7d7a","tags":["web"]},{"url":"https://github.com/advisories/GHSA-ghq9-vc6f-8qjf","tags":["advisory"]},{"url":"https://github.com/microsoft/torchgeo","tags":["package"]},{"url":"https://github.com/torchgeo/torchgeo","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-49048","title":"TorchGeo Remote Code Execution Vulnerability","description":"TorchGeo Remote Code Execution Vulnerability","status":"published","published":"2024-11-12T17:54:25.693Z","modified":"2025-07-08T15:41:58.809Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C","level":"high","assessor":"cna"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:33:56.402064Z"}],"euvd":[{"id":"EUVD-2024-0217","description":"TorchGeo Remote Code Execution Vulnerability","status":"published","published":"2024-11-12T17:54:25Z","modified":"2025-07-08T15:41:58Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C","level":"high"}],"updated_at":"2026-11-02T20:32:11.549296Z"}],"ghsa":[{"id":"GHSA-g5vp-j278-8pjh","title":"Duplicate Advisory: TorchGeo Remote Code Execution Vulnerability","description":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-ghq9-vc6f-8qjf. This link is maintained to preserve external references.\n\n## Original Description\nTorchGeo Remote Code Execution Vulnerability","status":"withdrawn","published":"2024-11-12T18:30:59Z","modified":"2026-04-01T00:03:50Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:39:47.075804Z"},{"id":"GHSA-ghq9-vc6f-8qjf","title":"TorchGeo Remote Code Execution Vulnerability","description":"### Impact\n\nTorchGeo 0.4–0.6.0 used an [`eval`](https://docs.python.org/3/library/functions.html#eval) statement in its model weight API that could allow an unauthenticated, remote attacker to execute arbitrary commands. All platforms that expose [`torchgeo.models.get_weight()`](https://torchgeo.readthedocs.io/en/v0.6.0/api/models.html#torchgeo.models.get_weight) or [`torchgeo.trainers`](https://torchgeo.readthedocs.io/en/v0.6.0/api/trainers.html) as an external API could be affected.\n\n### Patches\n\nThe `eval` statement was replaced with a fixed enum lookup, preventing arbitrary code injection. All users are encouraged to upgrade to TorchGeo 0.6.1 or newer.\n\n### Workarounds\n\nIn unpatched versions, input validation and sanitization can be used to avoid this vulnerability.\n\n### References\n\n#### Bug history\n\n* Introduced: https://github.com/torchgeo/torchgeo/pull/917\n* Patched: https://github.com/torchgeo/torchgeo/pull/2323\n* Released: [v0.6.1](https://github.com/microsoft/torchgeo/releases/tag/v0.6.1)","status":"published","published":"2026-04-01T00:03:56Z","modified":"2026-04-01T00:03:57Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-94","CWE-95"],"updated_at":"2026-11-02T14:39:47.075804Z"}],"nvd":[{"id":"CVE-2024-49048","description":"TorchGeo Remote Code Execution Vulnerability","status":"published","published":"2024-11-12T18:15:45.353Z","modified":"2026-06-17T07:59:17.827Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:10:36.931115Z"}],"osv":[{"id":"CVE-2024-49048","description":"TorchGeo Remote Code Execution Vulnerability","status":"published","published":"2024-11-12T18:15:45.353Z","modified":"2026-10-24T10:30:15.705623636Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:43.597758Z"},{"id":"GHSA-g5vp-j278-8pjh","title":"Duplicate Advisory: TorchGeo Remote Code Execution Vulnerability","description":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-ghq9-vc6f-8qjf. This link is maintained to preserve external references.\n\n## Original Description\nTorchGeo Remote Code Execution Vulnerability","status":"withdrawn","published":"2024-11-12T18:30:59Z","modified":"2026-09-10T03:50:20.783123033Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:46:47.472172Z"},{"id":"GHSA-ghq9-vc6f-8qjf","title":"TorchGeo Remote Code Execution Vulnerability","description":"### Impact\n\nTorchGeo 0.4–0.6.0 used an [`eval`](https://docs.python.org/3/library/functions.html#eval) statement in its model weight API that could allow an unauthenticated, remote attacker to execute arbitrary commands. All platforms that expose [`torchgeo.models.get_weight()`](https://torchgeo.readthedocs.io/en/v0.6.0/api/models.html#torchgeo.models.get_weight) or [`torchgeo.trainers`](https://torchgeo.readthedocs.io/en/v0.6.0/api/trainers.html) as an external API could be affected.\n\n### Patches\n\nThe `eval` statement was replaced with a fixed enum lookup, preventing arbitrary code injection. All users are encouraged to upgrade to TorchGeo 0.6.1 or newer.\n\n### Workarounds\n\nIn unpatched versions, input validation and sanitization can be used to avoid this vulnerability.\n\n### References\n\n#### Bug history\n\n* Introduced: https://github.com/torchgeo/torchgeo/pull/917\n* Patched: https://github.com/torchgeo/torchgeo/pull/2323\n* Released: [v0.6.1](https://github.com/microsoft/torchgeo/releases/tag/v0.6.1)","status":"published","published":"2026-04-01T00:03:56Z","modified":"2026-04-01T00:26:15.674531Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-94","CWE-95"],"updated_at":"2026-11-02T15:46:47.822182Z"},{"id":"PYSEC-2024-204","description":"TorchGeo Remote Code Execution Vulnerability","status":"published","published":"2024-11-12T18:15:45Z","modified":"2026-06-10T17:02:44.138854637Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:54.242332Z"}]}}