Read the docs
TI-2024-02722 Aliases CVE-2024-2914GHSA-g8hw-97v7-43q8

TarSlip Vulnerability in deepjavalibrary/djl

Priority HIGH 73CWE-29Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

A TarSlip vulnerability exists in the deepjavalibrary/djl, affecting version 0.26.0 and fixed in version 0.27.0. This vulnerability allows an attacker to manipulate file paths within tar archives to overwrite arbitrary files on the target system. Exploitation of this vulnerability could lead to remote code execution, privilege escalation, data theft or manipulation, and denial of service. The vulnerability is due to improper validation of file paths during the extraction of tar files, as demonstrated in multiple occurrences within the library's codebase, including but not limited to the files_util.py and extract_imagenet.py scripts.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00917 60th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed deepjavalibrary/djl (deepjavalibrary): 0.27.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
deepjavalibrarydeepjavalibrary/djlbefore 0.27.00.27.0Patch availableCNA
  • deepjavalibrary/djl Vendordeepjavalibrary Affected before 0.27.0 Fixed in 0.27.0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:djl:deep_java_library:0.26.0:*:*:*:*:*:*:*0.26.0VulnerableDjl
  • cpe:2.3:a:djl:deep_java_library:0.26.0:*:*:*:*:*:*:* Versions 0.26.0 Vulnerable ·Djl

Remediation

  • Fix · CNA deepjavalibrary/djl (deepjavalibrary) Fixed in 0.27.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-2914
  2. 2026-10-03 Alias added: GHSA-g8hw-97v7-43q8

References

Exploit 1

Patch 1

  • TI-2024-25218 Path thraversal in DeepJavaLibrary CVSS 3.1CRITICAL 10.0

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences