---
id: "CVE-2026-111865"
kind: "vulnerability"
aliases: ["CVE-2026-111865"]
title: "YOLOE model loader lets crafted model metadata run code locally"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "THU-MIG/yoloe", "fixed": [], "affected": "<= 40cd606cabdbe2b566d6f14a6b162c89206e9a1b (no versioning)", "ecosystem": "github"}]
ecosystems: []
tags: ["ai-tooling", "computer-vision", "eval-injection", "ml-models", "onnx", "python", "ultralytics", "yoloe"]
not_affected_if: ["no-untrusted-model-files", "not-using-onnx-backend", "trusted-models-only"]
published_at: "2026-10-17T21:16:25+00:00"
first_seen_at: "2026-10-23T21:57:14+00:00"
updated_at: "2026-10-25T04:27:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111865", "first_seen_at": "2026-10-23T21:57:14+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-25T04:27:52+00:00"}]
---

# YOLOE model loader lets crafted model metadata run code locally

THU-MIG yoloe's AutoBackend model loader passes the imgsz, names and kpt_shape values to eval() in ultralytics/nn/autobackend.py without neutralizing them. A local attacker who supplies a crafted model configuration can get the loading process to execute arbitrary code.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- github:THU-MIG/yoloe affected <= 40cd606cabdbe2b566d6f14a6b162c89206e9a1b (no versioning) fixed ?

## How to check

Run 'git rev-parse HEAD' in your yoloe checkout; if it is 40cd606cabdbe2b566d6f14a6b162c89206e9a1b (the latest commit) you are on the vulnerable code. Run 'grep -n "eval(v)" ultralytics/nn/autobackend.py': a match (line ~483) means unpatched. Exposure only matters if you load ONNX files from outside your control through AutoBackend / yolo predict.

## Fix

No fixed release; yoloe has no versions or PyPI package and HEAD 40cd606 is unpatched. Workaround from issue #148 (reporter's suggestion, not maintainer-confirmed): in ultralytics/nn/autobackend.py change 'metadata[k] = eval(v)' (line ~483) to 'metadata[k] = ast.literal_eval(v)' (ast is already imported), or resync the vendored ultralytics to >= 8.3.234. Until then, do not load .onnx files you did not produce.

## Timeline

- 2026-10-23T21:57:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111865
- 2026-10-25T04:27:52+00:00 analyst — No upstream fix: yoloe HEAD still 40cd606 (last push 2025-06-26), issue #148 open, no maintainer reply. Real vector is untrusted .onnx metadata_props eval'd at autobackend.py:483 (vendored ultralytics 8.3.39). Reporter's workaround (ast.literal_eval, or ultralytics >=8.3.234) is from the issue, not vendor-confirmed; nothing verified. No PoC link in sources (reporter withheld exploit string).

## Documents

- [advisory] THU-MIG/yoloe #148: ONNX metadata evaluated with eval() in vendored ultralytics 8.3.39 https://github.com/THU-MIG/yoloe/issues/148
- [mentions] THU-MIG/yoloe commit history (HEAD 40cd606, 2025-06-26) https://github.com/THU-MIG/yoloe/commits/main

## From the sources

A security flaw has been discovered in THU-MIG yoloe up to 40cd606cabdbe2b566d6f14a6b162c89206e9a1b. This affects the function eval of the file ultralytics/nn/autobackend.py of the component AutoBackend Model Loading. The manipulation of the argument imgsz/names/kpt_shape results in improper neutralization of directives in dynamically evaluated code. The attack requires a local approach. The exploit has been released to the public and may be used for attacks. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_