{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "ultralytics",
        "purl": "pkg:pypi/ultralytics"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.3.41"
            },
            {
              "fixed": "8.3.47"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "8.3.41",
        "8.3.42",
        "8.3.45",
        "8.3.46",
        "8.3.43",
        "8.3.44"
      ]
    }
  ],
  "details": "Ultralytics has identified a supply chain attack\naffecting affecting multiple versions of the ultralytics package.\nThe compromised versions contained unauthorized code that\ndownloaded and executed cryptocurrency mining software\nwhen instantiating YOLO models.\nThis code was injected into the PyPI release artifacts and was not present\nin the public GitHub repository.\n",
  "id": "PYSEC-2024-154",
  "modified": "2024-12-10T19:20:27.097505+00:00",
  "references": [
    {
      "type": "EVIDENCE",
      "url": "https://inspector.pypi.io/project/ultralytics/8.3.41/packages/d0/99/13d92174aa6a470d348a95e31164769f2cdf77838ea3c3e3fd476285777d/ultralytics-8.3.41-py3-none-any.whl/ultralytics/utils/downloads.py#line.284"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ultralytics/ultralytics/pull/18020#issuecomment-2525180194"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/ultralytics/ultralytics/issues/18027"
    },
    {
      "type": "FIX",
      "url": "https://github.com/ultralytics/ultralytics/pull/18052"
    },
    {
      "type": "FIX",
      "url": "https://github.com/ultralytics/ultralytics/pull/18111"
    },
    {
      "type": "FIX",
      "url": "https://github.com/ultralytics/ultralytics/releases/tag/v8.3.48"
    },
    {
      "type": "ARTICLE",
      "url": "https://blog.yossarian.net/2024/12/06/zizmor-ultralytics-injection"
    }
  ],
  "related": [
    "GHSA-7x29-qqmq-v6qc"
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "A number of releases of ultralytics contained malicious crypto miner software."
}