{"id":"CVE-2026-111865","kind":"vulnerability","aliases":["CVE-2026-111865"],"related":[],"title":"YOLOE model loader lets crafted model metadata run code locally","description":"A security flaw has been discovered in THU-MIG yoloe up to 40cd606cabdbe2b566d6f14a6b162c89206e9a1b. This affects the function eval of the file ultralytics/nn/autobackend.py of the component AutoBackend Model Loading. The manipulation of the argument imgsz/names/kpt_shape results in improper neutralization of directives in dynamically evaluated code. The attack requires a local approach. The exploit has been released to the public and may be used for attacks. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.","summary":"THU-MIG yoloe's AutoBackend model loader passes the imgsz, names and kpt_shape values to eval() in ultralytics/nn/autobackend.py without neutralizing them. A local attacker who supplies a crafted model configuration can get the loading process to execute arbitrary code.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"THU-MIG/yoloe","fixed":[],"affected":"<= 40cd606cabdbe2b566d6f14a6b162c89206e9a1b (no versioning)","ecosystem":"github"}],"ecosystems":[],"tags":["ai-tooling","computer-vision","eval-injection","ml-models","onnx","python","ultralytics","yoloe"],"not_affected_if":["no-untrusted-model-files","not-using-onnx-backend","trusted-models-only"],"how_to_check":"Run 'git rev-parse HEAD' in your yoloe checkout; if it is 40cd606cabdbe2b566d6f14a6b162c89206e9a1b (the latest commit) you are on the vulnerable code. Run 'grep -n \"eval(v)\" ultralytics/nn/autobackend.py': a match (line ~483) means unpatched. Exposure only matters if you load ONNX files from outside your control through AutoBackend / yolo predict.","fix":"No fixed release; yoloe has no versions or PyPI package and HEAD 40cd606 is unpatched. Workaround from issue #148 (reporter's suggestion, not maintainer-confirmed): in ultralytics/nn/autobackend.py change 'metadata[k] = eval(v)' (line ~483) to 'metadata[k] = ast.literal_eval(v)' (ast is already imported), or resync the vendored ultralytics to >= 8.3.234. Until then, do not load .onnx files you did not produce.","status":"open","published_at":"2026-10-17T21:16:25+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-25T04:26:49+00:00","updated_at":"2026-10-25T04:27:52+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-10-25T04:26:49Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"YOLOE model loader lets crafted model metadata run code locally","impact":"high","summary":"THU-MIG yoloe's AutoBackend model loader passes the imgsz, names and kpt_shape values to eval() in ultralytics/nn/autobackend.py without neutralizing them. A local attacker who supplies a crafted model configuration can get the loading process to execute arbitrary code.","category":"ai-tooling","nicknames":[],"who_cares":["yoloe","ultralytics","python","ml-models","computer-vision"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Arbitrary code runs as the user loading the model.","analyst_note":"Find a fixed version or upstream patch for THU-MIG yoloe, since the sources list none and the project has not responded; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-111865 for the vector and any fix.","how_to_check":"- Check whether the project is in use with `grep -rn \"AutoBackend\" .` in the repository, and confirm the code path with `sed -n '1,200p' ultralytics/nn/autobackend.py`\n- Look for the `eval(` call in `ultralytics/nn/autobackend.py` that handles imgsz, names or kpt_shape\n- Check the commit in use against `40cd606cabdbe2b566d6f14a6b162c89206e9a1b`, since the sources list this as the last affected revision","needs_analyst":true,"not_affected_if":["trusted-models-only","no-untrusted-model-files"],"who_is_affected":"Teams that load YOLOE or other ultralytics-based models through AutoBackend, especially from model files or configs they did not create themselves. The flaw needs local access and a crafted input, so systems that only load models from trusted, internal sources have lower exposure. The sources do not name a fixed version, and the project has not responded to the report.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000699,"input_tokens":3450,"output_tokens":708,"severity_before":"medium"},"analyst_status":"done","analyst_note":"Find a fixed version or upstream patch for THU-MIG yoloe, since the sources list none and the project has not responded; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-111865 for the vector and any fix.","search":"'-111865':13A,16A '-2026':12A,15A '/yoloe':20A '40cd606cabdbe2b566d6f14a6b162c89206e9a1b':91C 'affect':93C,154C 'ai':22B 'ai-tool':21B 'approach':128C 'arbitrari':76B 'argument':111C 'attack':62B,124C,142C 'autobackend':42B,104C 'code':9A,77B,122C 'compon':103C 'comput':25B 'computer-vis':24B 'configur':68B 'craft':5A,66B 'cve':11A,14A 'direct':118C 'discov':83C 'dynam':120C 'earli':167C 'eval':28B,54B,96C 'eval-inject':27B 'evalu':121C 'execut':75B 'exploit':130C 'file':99C 'flaw':80C 'function':95C 'get':70B 'imgsz':47B 'imgsz/names/kpt_shape':112C 'improp':115C 'inform':152C,163C 'inject':29B 'issu':170C 'kpt':50B 'let':4A 'load':72B,106C 'loader':3A,44B 'local':10A,61B,127C 'manipul':108C 'may':138C 'metadata':7A 'mig':19A,39B,87C 'ml':31B 'ml-model':30B 'model':2A,6A,32B,43B,67B,105C 'name':48B 'neutral':58B,116C 'onnx':33B 'pass':45B 'problem':166C 'process':73B 'product':144C 'project':161C 'public':136C 'python':34B 'releas':133C,157C 'report':171C 'requir':125C 'respond':175C 'result':113C 'run':8A 'secur':79C 'shape':51B 'suppli':64B 'thu':18A,38B,86C 'thu-mig':17A,37B,85C 'tool':23B 'ultralyt':35B 'ultralytics/nn/autobackend.py':56B,100C 'unaffect':156C 'unavail':159C 'use':140C,147C 'valu':52B 'version':148C 'vision':26B 'without':57B 'yet':176C 'yolo':1A,36B,40B,88C","nicknames":[],"mitigations":[],"who_affected":"Anyone running THU-MIG yoloe from source (no PyPI package) who loads .onnx model files made by someone else; the metadata strings imgsz, names and kpt_shape are eval'd when the model loads, so a crafted file runs Python with the loading process's privileges (tokens, datasets, cloud credentials). Other repos vendoring ultralytics 8.3.39 or similarly old copies share the same line. Teams that only load models they exported themselves can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-17T21:16:25+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111865","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111865","severity":null,"published_at":"2026-10-17T21:16:25+00:00","modified_at":"2026-10-19T22:10:00+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-111865:813","url":null,"severity":null,"published_at":"2026-10-25T04:27:52+00:00","modified_at":"2026-10-25T04:27:52+00:00","first_seen_at":"2026-10-25T04:27:52+00:00","fetched_at":"2026-10-25T04:27:52+00:00","note":"No upstream fix: yoloe HEAD still 40cd606 (last push 2025-06-26), issue #148 open, no maintainer reply. Real vector is untrusted .onnx metadata_props eval'd at autobackend.py:483 (vendored ultralytics 8.3.39). Reporter's workaround (ast.literal_eval, or ultralytics >=8.3.234) is from the issue, not vendor-confirmed; nothing verified. No PoC link in sources (reporter withheld exploit string)."}],"documents":[{"id":3394,"url":"https://github.com/THU-MIG/yoloe/issues/148","title":"THU-MIG/yoloe #148: ONNX metadata evaluated with eval() in vendored ultralytics 8.3.39","kind":"issue","source":"analyst","text":"Open issue by 3em0, 2026-09-29. Source autobackend.py:220 reads custom_metadata_map; sink :483 metadata[k]=eval(v). HEAD 40cd606 (last push 2025-06-26). Suggested fix: sync vendored ultralytics >= 8.3.234 or replace eval(v) with ast.literal_eval(v). Reporter says verified by executing byte-identical ultralytics 8.3.39 wheel. No maintainer response.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":3395,"url":"https://github.com/THU-MIG/yoloe/commits/main","title":"THU-MIG/yoloe commit history (HEAD 40cd606, 2025-06-26)","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}