{"id":"CVE-2026-111991","kind":"vulnerability","aliases":["CVE-2026-111991"],"related":[],"title":"yolov9: ONNX metadata handling lets a model file inject code","description":"A security vulnerability has been detected in WongKinYiu yolov9 0.1. This vulnerability affects the function DetectMultiBackend.__init__ of the file models/common.py of the component ONNX Metadata Handler. The manipulation of the argument names/stride leads to code injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.","summary":"The DetectMultiBackend loader in WongKinYiu yolov9 0.1 parses ONNX model metadata, and manipulating the names or stride values in that metadata leads to code injection. An attacker who gets a crafted ONNX model loaded can run code on the machine that loads it.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["computer-vision","ml-inference","package","python","yolov9"],"not_affected_if":["not-using-yolov9","trusted-models-only"],"how_to_check":"- Check whether the project pins `yolov9` at `0.1` or runs `models/common.py` from a checkout of this repository\n- Search the codebase for `DetectMultiBackend` and for loading of `.onnx` files from untrusted sources","fix":"- unknown: the sources report that the project has not responded and name no patched version or workaround","status":"open","published_at":"2026-10-18T15:16:52+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T03:23:31+00:00","updated_at":"2026-10-25T03:23:31+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:23:31Z","model":"claude-haiku-5-5","output":{"fix":"- unknown: the sources report that the project has not responded and name no patched version or workaround","reach":"network","title":"yolov9: ONNX metadata handling lets a model file inject code","impact":"high","summary":"The DetectMultiBackend loader in WongKinYiu yolov9 0.1 parses ONNX model metadata, and manipulating the names or stride values in that metadata leads to code injection. An attacker who gets a crafted ONNX model loaded can run code on the machine that loads it.","category":"package","nicknames":[],"who_cares":["python","yolov9","computer-vision","ml-inference"],"confidence":0.6,"needs_auth":"unknown","worst_case":"code runs on the server that loads the model","analyst_note":"Confirm the affected code path and whether an ONNX model file from an untrusted source is enough to trigger it; check the NVD page and the linked project issue for a fix or workaround.","how_to_check":"- Check whether the project pins `yolov9` at `0.1` or runs `models/common.py` from a checkout of this repository\n- Search the codebase for `DetectMultiBackend` and for loading of `.onnx` files from untrusted sources","needs_analyst":true,"not_affected_if":["trusted-models-only","not-using-yolov9"],"who_is_affected":"Teams that load ONNX model files with yolov9's DetectMultiBackend, especially models downloaded or uploaded from outside their control. Systems that only load their own trusted, locally built weights are less exposed, though the sources do not say this removes the risk. Teams not using this repository can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000626,"input_tokens":3357,"output_tokens":580,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-111991':13A,16A '-2026':12A,15A '0.1':32B,77C 'affect':80C 'argument':98C 'attack':52B,108C 'code':10A,49B,62B,102C 'compon':90C 'comput':18B 'computer-vis':17B 'craft':56B 'cve':11A,14A 'detect':73C 'detectmultibackend':27B 'detectmultibackend.__init__':83C 'disclos':115C 'earli':128C 'exploit':105C,112C 'file':8A,86C 'function':82C 'get':54B 'handl':4A 'handler':93C 'infer':22B 'inform':124C 'inject':9A,50B,103C 'issu':131C 'lead':47B,100C 'let':5A 'load':59B,67B 'loader':28B 'machin':65B 'manipul':38B,95C 'may':118C 'metadata':3A,36B,46B,92C 'ml':21B 'ml-infer':20B 'model':7A,35B,58B 'models/common.py':87C 'name':40B 'names/stride':99C 'onnx':2A,34B,57B,91C 'packag':23B 'pars':33B 'possibl':110C 'problem':127C 'project':122C 'public':116C 'python':24B 'remot':104C 'report':132C 'respond':136C 'run':61B 'secur':69C 'stride':42B 'use':120C 'valu':43B 'vision':19B 'vulner':70C,79C 'wongkinyiu':30B,75C 'yet':137C 'yolov9':1A,25B,31B,76C","nicknames":[],"mitigations":[],"who_affected":"Teams that load ONNX model files with yolov9's DetectMultiBackend, especially models downloaded or uploaded from outside their control. Systems that only load their own trusted, locally built weights are less exposed, though the sources do not say this removes the risk. Teams not using this repository can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T15:16:52+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111991","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111991","severity":null,"published_at":"2026-10-18T15:16:52+00:00","modified_at":"2026-10-22T03:16:32+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}