High · published January 28, 2025
🚨 An account on a vulnerable CVAT instance can let an attacker run arbitrary code — like handing a stranger the keys to your car instead of just giving directions! 🔥 Think of it as a restaurant that allows anyone with a reservation to mess with the kitchen. If they have a wild idea for a dish and the chef has a poorly written recipe book, chaos could ensue! If exploited, an attacker could execute malicious code within the Nuclio function container, potentially leading to unauthorized access to sensitive data or manipulation of your annotation workflow. The consequences could be absolutely devastating!
Think of it as a restaurant that allows anyone with a reservation to mess with the kitchen. If they have a wild idea for a dish and the chef has a poorly written recipe book, chaos could ensue! This vulnerability arises when an account on CVAT runs serverless functions that utilize unsafe libraries for state serialization, such as pickle or jsonpickle, which can be exploited to execute arbitrary code.
If exploited, an attacker could execute malicious code within the Nuclio function container, potentially leading to unauthorized access to sensitive data or manipulation of your annotation workflow. The consequences could be absolutely devastating! Upgrade your CVAT deployment to version 2.26.0 or higher immediately. If upgrading isn't an option, shut down any instances of the TransT or SiamMask functions you’re currently running to mitigate risk. You've got this! With these steps, you’ll have your CVAT secured in no time! 🛡️