HIGH7.1
PYSEC-2026-1406
GluonCV Arbitrary File Write via TarSlip
Details
A vulnerability in the `ImageClassificationDataset.from_csv()` API of the `dmlc/gluon-cv` repository, version 0.10.0, allows for arbitrary file write. The function downloads and extracts `tar.gz` files from URLs without proper sanitization, making it susceptible to a TarSlip vulnerability. Attackers can exploit this by crafting malicious tar files that, when extracted, can overwrite files on the victim's system via path traversal or faked symlinks.
Are you affected?
Enter the version of the package you're using.
Affected packages
PyPI/gluoncv
Introduced in:
0No fixed version published yet for gluoncv (pip). Pin to a known-safe version or switch to an alternative.
References
- https://nvd.nist.gov/vuln/detail/CVE-2024-12216[ADVISORY]
- https://github.com/dmlc/gluon-cv[PACKAGE]
- https://github.com/dmlc/gluon-cv/blob/3862e2db33ab650eff7c7c5c5891e805207027b1/gluoncv/utils/filesystem.py#L223-L229[WEB]
- https://huntr.com/bounties/46081fdc-2951-4deb-a2c9-2627007bdce0[WEB]
- https://pypi.org/project/gluoncv[PACKAGE]
- https://github.com/advisories/GHSA-m724-hqmc-ggpx[ADVISORY]