{"action":"Upgrade ultralytics to 8.3.47 or later.","affected":[{"fixed":"8.3.47","introduced":"8.3.41"}],"component":"ultralytics","cve_ids":[],"ecosystem":"PyPI","exploited":false,"fixed_versions":["8.3.47"],"id":"tcs_01M5KGM5GR9PF6XXMC27GFDWGA","modified_at":"2026-06-28T22:30:11.689251300Z","published_at":"2024-12-10T19:19:10Z","references":["https://osv.dev/vulnerability/PYSEC-2024-154","https://inspector.pypi.io/project/ultralytics/8.3.41/packages/d0/99/13d92174aa6a470d348a95e31164769f2cdf77838ea3c3e3fd476285777d/ultralytics-8.3.41-py3-none-any.whl/ultralytics/utils/downloads.py#line.284","https://github.com/ultralytics/ultralytics/pull/18020#issuecomment-2525180194","https://github.com/ultralytics/ultralytics/issues/18027","https://github.com/ultralytics/ultralytics/pull/18052","https://github.com/ultralytics/ultralytics/pull/18111","https://github.com/ultralytics/ultralytics/releases/tag/v8.3.48","https://blog.yossarian.net/2024/12/06/zizmor-ultralytics-injection"],"severity":{"label":"high","score":8.6},"sources":[{"source":"osv","source_id":"PYSEC-2024-154","url":"https://osv.dev/vulnerability/PYSEC-2024-154"}],"summary":"A number of releases of ultralytics contained malicious crypto miner software."}