GitHub Advisoryadvisory · PyPI

GHSA-ghq9-vc6f-8qjf TorchGeo Remote Code Execution Vulnerability

HIGH Published 2026-04-01 Modified 2026-04-01 Official page ↗
Aliases
CVE-2024-49048
Ecosystem
PyPI
Packages
torchgeo
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-94, CWE-95
Reviewed
2026-04-01

Affected packages

• PyPI torchgeo: >= 0.4, < 0.6.1 → fixed in 0.6.1

Description

Impact TorchGeo 0.4–0.6.0 used an `eval` statement in its model weight API that could allow an unauthenticated, remote attacker to execute arbitrary commands. All platforms that expose `torchgeo.models.get_weight()` or `torchgeo.trainers` as an external API could be affected. Patches The `eval` statement was replaced with a fixed enum lookup, preventing arbitrary code injection. All users are encouraged to upgrade to TorchGeo 0.6.1 or newer. Workarounds In unpatched versions, input validation and sanitization can be used to avoid this vulnerability. References Bug history • Introduced: https://github.com/torchgeo/torchgeo/pull/917 • Patched: https://github.com/torchgeo/torchgeo/pull/2323 • Released: v0.6.1

Related

Alias · CVE (1)

  • CVE-2024-49048 TorchGeo Remote Code Execution Vulnerability vulnerability

Weakness · CWE (2)

  • CWE-94 Improper Control of Generation of Code weakness
  • CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code weakness

References