PyPI/ultralytics: high 8.6
A number of releases of ultralytics contained malicious crypto miner software.
Action: Upgrade ultralytics to 8.3.47 or later.
pip install ultralytics==8.3.47Affected
| introduced | fixed | last affected |
|---|---|---|
| 8.3.41 | 8.3.47 | - |
Fixed versions
| 8.3.47 |
Sources
- osv: PYSEC-2024-154
- https://inspector.pypi.io/project/ultralytics/8.3.41/packages/d0/99/13d92174aa6a470d348a95e31164769f2cdf77838ea3c3e3fd476285777d/ultralytics-8.3.41-py3-none-any.whl/ultralytics/utils/downloads.py#line.284
- https://github.com/ultralytics/ultralytics/pull/18020#issuecomment-2525180194
- https://github.com/ultralytics/ultralytics/issues/18027
- https://github.com/ultralytics/ultralytics/pull/18052
- https://github.com/ultralytics/ultralytics/pull/18111
- https://github.com/ultralytics/ultralytics/releases/tag/v8.3.48
- https://blog.yossarian.net/2024/12/06/zizmor-ultralytics-injection
published · modified · JSON