{"id":"CVE-2026-111212","kind":"vulnerability","aliases":["CVE-2026-111212"],"related":[],"title":"Medical-SAM-Adapter: model loading lets a local file run injected code","description":"A security flaw has been discovered in ImprintLab Medical-SAM-Adapter 0.1.0-alpha/0.1.0. Affected by this issue is the function session.get_modelmeta.custom_metadata_map of the file models/MobileSAMv2/ultralytics/nn/autobackend.py of the component AutoBackend Model Loading. The manipulation of the argument imgsz/names/kpt_shape results in improper neutralization of directives in dynamically evaluated code. The attack requires a local approach. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.","summary":"ImprintLab Medical-SAM-Adapter 0.1.0 and 0.1.0-alpha load model metadata through AutoBackend, which evaluates crafted imgsz, names or kpt_shape values as code. A local attacker who supplies a malicious model file can run commands as the user loading it, and a public exploit exists.","severity":"medium","cvss":4.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["medical-imaging","ml-models","package","python","self-hosted"],"not_affected_if":["other-versions","trusted-models-only"],"how_to_check":"- Check whether the project in use is Medical-SAM-Adapter at `0.1.0-alpha` or `0.1.0`.\n- Look for `models/MobileSAMv2/ultralytics/nn/autobackend.py` in the codebase and see whether `custom_metadata_map` is evaluated with `eval` or `exec`.\n- Confirm whether untrusted model files are loaded from disk or shared storage.","fix":null,"status":"open","published_at":"2026-10-16T03:18:03+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","triaged_at":"2026-10-25T04:34:50+00:00","updated_at":"2026-10-25T04:34:50+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:34:50Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Medical-SAM-Adapter: model loading lets a local file run injected code","impact":"high","summary":"ImprintLab Medical-SAM-Adapter 0.1.0 and 0.1.0-alpha load model metadata through AutoBackend, which evaluates crafted imgsz, names or kpt_shape values as code. A local attacker who supplies a malicious model file can run commands as the user loading it, and a public exploit exists.","category":"package","nicknames":[],"who_cares":["python","medical-imaging","ml-models","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Code runs as the user who loads the malicious model file.","analyst_note":"Check the NVD entry and the project repository for a fixed version or patch; the sources say the vendor has not responded.","how_to_check":"- Check whether the project in use is Medical-SAM-Adapter at `0.1.0-alpha` or `0.1.0`.\n- Look for `models/MobileSAMv2/ultralytics/nn/autobackend.py` in the codebase and see whether `custom_metadata_map` is evaluated with `eval` or `exec`.\n- Confirm whether untrusted model files are loaded from disk or shared storage.","needs_analyst":true,"not_affected_if":["trusted-models-only","other-versions"],"who_is_affected":"Teams running ImprintLab Medical-SAM-Adapter 0.1.0-alpha or 0.1.0 that load model weights or metadata from files they did not create. Exposure depends on a local attacker being able to place a model file where the loader reads it. Teams that only use models they built or trust, or that run other versions, can skip this.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000659,"input_tokens":3439,"output_tokens":630,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-111212':16A,19A '-2026':15A,18A '0.1.0':36B,38B,90C 'adapt':4A,35B,89C 'affect':92C 'alpha':39B 'alpha/0.1.0':91C 'approach':133C 'argument':116C 'attack':58B,129C,147C 'autobackend':44B,109C 'code':13A,55B,127C 'command':67B 'compon':108C 'craft':47B 'cve':14A,17A 'direct':123C 'discov':83C 'dynam':125C 'earli':155C 'evalu':46B,126C 'exist':77B 'exploit':76B,135C 'file':10A,64B,104C 'flaw':80C 'function':98C 'host':30B 'imag':22B 'imgsz':48B 'imgsz/names/kpt_shape':117C 'imprintlab':31B,85C 'improp':120C 'inform':151C 'inject':12A 'issu':95C,158C 'kpt':51B 'let':7A 'load':6A,40B,71B,111C 'local':9A,57B,132C 'malici':62B 'manipul':113C 'map':101C 'may':143C 'medic':2A,21B,33B,87C 'medical-imag':20B 'medical-sam-adapt':1A,32B,86C 'metadata':42B,100C 'ml':24B 'ml-model':23B 'model':5A,25B,41B,63B,110C 'models/mobilesamv2/ultralytics/nn/autobackend.py':105C 'name':49B 'neutral':121C 'packag':26B 'problem':154C 'project':149C 'public':75B,141C 'python':27B 'releas':138C 'report':159C 'requir':130C 'respond':163C 'result':118C 'run':11A,66B 'sam':3A,34B,88C 'secur':79C 'self':29B 'self-host':28B 'session.get_modelmeta.custom':99C 'shape':52B 'suppli':60B 'use':145C 'user':70B 'valu':53B 'yet':164C","nicknames":[],"mitigations":[],"who_affected":"Teams running ImprintLab Medical-SAM-Adapter 0.1.0-alpha or 0.1.0 that load model weights or metadata from files they did not create. Exposure depends on a local attacker being able to place a model file where the loader reads it. Teams that only use models they built or trust, or that run other versions, can skip this.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T03:18:03+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111212","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111212","severity":null,"published_at":"2026-10-16T03:18:03+00:00","modified_at":"2026-10-16T19:21:14+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","fetched_at":"2026-10-23T22:28:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}