PT-2024-8093 · Torchgeo · Torchgeo

Zpbrent · Published 2024-11-12 · Updated 2026-04-01 · CVE-2024-49048

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: TorchGeo (affected versions not specified)

Description: The issue is related to incorrect code generation management in the TorchGeo library, which handles geospatial data. This can allow a remote attacker to execute arbitrary code.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Code Injection

Eval Injection

Weakness Enumeration

CWE-94

CWE-95

Related Identifiers

BDU:2024-09614

CVE-2024-49048

GHSA-G5VP-J278-8PJH

GHSA-GHQ9-VC6F-8QJF

PYSEC-2024-204

Affected Products

Torchgeo

References · 21

• https://osv.dev/vulnerability/CVE-2024-49048 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-49048 · Security Note
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49048 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-g5vp-j278-8pjh · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2024-204 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-ghq9-vc6f-8qjf · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-09614 · Security Note
• https://github.com/microsoft/torchgeo/releases/tag/v0.6.1 · Note
• https://github.com/torchgeo/torchgeo/security/advisories/GHSA-ghq9-vc6f-8qjf · Note
• https://github.com/torchgeo/torchgeo/pull/917 · Note
• https://github.com/torchgeo/torchgeo · Note
• https://github.com/torchgeo/torchgeo/commit/1a980788cb7089a1115f3b786c7daa9dd47d7d7a · Note
• https://github.com/torchgeo/torchgeo/pull/2323 · Note
• https://github.com/microsoft/torchgeo · Note
• https://github.com/microsoft/torchgeo/pull/2323 · Note