{"id":"CVE-2026-111237","kind":"vulnerability","aliases":["CVE-2026-111237"],"related":[],"title":"Ultralytics FastSAM: model metadata loading lets crafted files run code locally","description":"A weakness has been identified in Ultralytics FastSAM up to b4ed20c2fed75eadc5aa7d8b09fedd137b873b52. This affects the function session.get_modelmeta.custom_metadata_map of the file ultralytics/nn/autobackend.py of the component AutoBackend Model Loading. This manipulation of the argument imgsz/names/kpt_shape causes improper neutralization of directives in dynamically evaluated code. The attack requires local access. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.","summary":"Ultralytics FastSAM's AutoBackend model loader evaluates values from model metadata (imgsz, names, kpt_shape) as code without neutralizing them. An attacker who can supply a model file that a user loads could run code on that machine.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","computer-vision","fastsam","python","ultralytics"],"not_affected_if":["no-untrusted-models"],"how_to_check":"- Check whether the project pins Ultralytics FastSAM from the repository at or before commit `b4ed20c2fed75eadc5aa7d8b09fedd137b873b52`, for example with `git log -1` in the checkout.\n- unknown for other checks; the sources do not give a command or file to confirm exposure beyond the affected function.","fix":"- unknown: the sources state the project has not responded and give no fixed version. Avoid loading untrusted model files with FastSAM until a fix is published.","status":"open","published_at":"2026-10-16T03:18:03+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","triaged_at":"2026-10-25T04:28:43+00:00","updated_at":"2026-10-25T04:28:43+00:00","category":"ai-tooling","confidence":0.6,"triage":{"at":"2026-10-25T04:28:43Z","model":"claude-haiku-5-5","output":{"fix":"- unknown: the sources state the project has not responded and give no fixed version. Avoid loading untrusted model files with FastSAM until a fix is published.","reach":"local","title":"Ultralytics FastSAM: model metadata loading lets crafted files run code locally","impact":"high","summary":"Ultralytics FastSAM's AutoBackend model loader evaluates values from model metadata (imgsz, names, kpt_shape) as code without neutralizing them. An attacker who can supply a model file that a user loads could run code on that machine.","category":"ai-tooling","nicknames":[],"who_cares":["ultralytics","fastsam","python","computer-vision"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker-supplied code runs on the machine loading the model file.","analyst_note":"Confirm whether a fixed release exists and check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-111237 for the exact exploit path and any safe version.","how_to_check":"- Check whether the project pins Ultralytics FastSAM from the repository at or before commit `b4ed20c2fed75eadc5aa7d8b09fedd137b873b52`, for example with `git log -1` in the checkout.\n- unknown for other checks; the sources do not give a command or file to confirm exposure beyond the affected function.","needs_analyst":true,"not_affected_if":["no-untrusted-models"],"who_is_affected":"Teams that load FastSAM or Ultralytics AutoBackend model files, especially model files from outside their own trust boundary. The sources describe a local attack, so exposure depends on whether an attacker can get a file loaded on a machine they can reach. Teams that only use models they built and stored themselves are less exposed.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000669,"input_tokens":3454,"output_tokens":647,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-111237':14A,17A '-2026':13A,16A 'access':112C 'affect':77C,131C 'ai':19B 'ai-tool':18B 'argument':97C 'attack':48B,109C 'autobackend':30B,90C 'avail':137C 'b4ed20c2fed75eadc5aa7d8b09fedd137b873b52':75C 'caus':99C 'code':10A,43B,61B,107C 'compon':89C 'comput':22B 'computer-vis':21B 'continu':122C 'could':59B 'craft':7A 'cve':12A,15A 'deliv':121C 'direct':103C 'dynam':105C 'earli':145C 'evalu':33B,106C 'fastsam':2A,24B,28B,72C 'file':8A,54B,85C 'function':79C 'identifi':69C 'imgsz':38B 'imgsz/names/kpt_shape':98C 'improp':100C 'inform':129C,141C 'issu':148C 'kpt':40B 'let':6A 'load':5A,58B,92C 'loader':32B 'local':11A,111C 'machin':64B 'manipul':94C 'map':82C 'metadata':4A,37B,81C 'model':3A,31B,36B,53B,91C,119C 'name':39B 'neutral':45B,101C 'problem':144C 'product':114C 'project':139C 'python':25B 'releas':118C,134C 'report':149C 'requir':110C 'respond':153C 'result':126C 'roll':117C 'run':9A,60B 'session.get_modelmeta.custom':80C 'shape':41B 'specif':127C 'suppli':51B 'tool':20B 'ultralyt':1A,26B,27B,71C 'ultralytics/nn/autobackend.py':86C 'updat':123C,133C 'use':115C 'user':57B 'valu':34B 'version':128C 'vision':23B 'weak':66C 'without':44B 'yet':154C","nicknames":[],"mitigations":[],"who_affected":"Teams that load FastSAM or Ultralytics AutoBackend model files, especially model files from outside their own trust boundary. The sources describe a local attack, so exposure depends on whether an attacker can get a file loaded on a machine they can reach. Teams that only use models they built and stored themselves are less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T03:18:03+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111237","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111237","severity":null,"published_at":"2026-10-16T03:18:03+00:00","modified_at":"2026-10-21T02:17:05+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","fetched_at":"2026-10-23T22:28:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}