Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

MMDetection v3.3.0 allows attackers to run malicious code on your server

CVE-2024-12044 · published 1 year ago
Summary

A security issue in MMDetection v3.3.0 allows hackers to inject and run their own code on your server if you're using its distributed training feature. This could lead to unauthorized access or data theft. Update to a secure version of MMDetection to prevent this.

Original advisory text
A remote code execution vulnerability exists in open-mmlab/mmdetection version v3.3.0. The vulnerability is due to the use of the `pickle.loads()` function in the `all_reduce_dict()` distributed tr...
A remote code execution vulnerability exists in open-mmlab/mmdetection version v3.3.0. The vulnerability is due to the use of the `pickle.loads()` function in the `all_reduce_dict()` distributed training API without proper sanitization. This allows an attacker to execute arbitrary code by broadcasting a malicious payload to the distributed training network.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.8 Critical
Exploitation
1% chance of attack within 30 days
Type
CWE-502Deserialization of Untrusted Data
Timeline
Published20 Mar 2025
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2024-12044 · NVD
Track software like this
Free during beta