Deserialization Vulnerability in YOLOv5 Affects Machine Learning Applications
CVE-2021-31680

7.8HIGH

Key Information:

Vendor

Ultralytics

Status
Yolov5
Vendor
CVE Published:
31 July 2023

What is CVE-2021-31680?

A deserialization vulnerability in YOLOv5 allows attackers to execute arbitrary code by sending specially crafted yaml files. This flaw can lead to significant security risks in machine learning applications, as it may enable unauthorized access or manipulation of data. Developers should ensure they are using the latest versions and implement proper validation and sanitization procedures when handling serialized data to mitigate potential threats.

References

https://huntr.dev/bounties/1-other-yolov5/

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.