CVE-2024-49361 Information

Description

ACON is a widely-used library of tools for machine learning that focuses on adaptive correlation optimization. A potential vulnerability has been identified in the input validation process which could lead to arbitrary code execution if exploited. This issue could allow an attacker to submit malicious input data bypassing input validation resulting in remote code execution in certain machine learning applications using the ACON library. All users utilizing ACON’s input-handling functions are potentially at risk. Specifically machine learning models or applications that ingest user-generated data without proper sanitization are the most vulnerable. Users running ACON on production servers are at heightened risk as the vulnerability could be exploited remotely. As of time of publication it is unclear whether a fix is available.

Reference

https://github.com/torinriley/ACON/security/advisories/GHSA-345g-6rmp-3cv9