AVID-2026-R1552

Description

TorchGeo Remote Code Execution Vulnerability (CVE-2024-49048)

Details

TorchGeo Remote Code Execution Vulnerability

Reason for inclusion in AVID: CVE-2024-49048 describes a remote code execution vulnerability in TorchGeo, a Python library used in ML/AI workflows (e.g., geospatial data processing with PyTorch). This directly concerns software used to build/train/deploy AI systems, representing a supply chain vulnerability in AI software stacks (dependencies/frameworks). It is a security/safety vulnerability (RCE) with available CVE reference and sources. The evidence in the report (CVE ID, description, and references) supports classification as a software supply chain vulnerability affecting AI pipelines.

References

Affected or Relevant Artifacts

Developer: Microsoft
Deployer: Microsoft
Artifact Details:

Type	Name
System	Microsoft TorchGeo

Impact

AVID Taxonomy Categorization

Risk domains: Security
SEP subcategories: S0100: Software Vulnerability
Lifecycle stages: L06: Deployment

CVSS

Version	3.1
Vector String	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Base Score	8.1
Base Severity	🔴 High

CWE

ID	Description
CWE-94	CWE-94: Improper Control of Generation of Code (‘Code Injection’)

Other information

Report Type: Advisory
Credits:
Date Reported: 2024-11-12
Version: 0.3.3
AVID Entry