---
id: "CVE-2026-111991"
kind: "vulnerability"
aliases: ["CVE-2026-111991"]
title: "yolov9: ONNX metadata handling lets a model file inject code"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["computer-vision", "ml-inference", "package", "python", "yolov9"]
not_affected_if: ["not-using-yolov9", "trusted-models-only"]
published_at: "2026-10-18T15:16:52+00:00"
first_seen_at: "2026-10-23T21:57:15+00:00"
updated_at: "2026-10-25T03:23:31+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111991", "first_seen_at": "2026-10-23T21:57:15+00:00"}]
---

# yolov9: ONNX metadata handling lets a model file inject code

The DetectMultiBackend loader in WongKinYiu yolov9 0.1 parses ONNX model metadata, and manipulating the names or stride values in that metadata leads to code injection. An attacker who gets a crafted ONNX model loaded can run code on the machine that loads it.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the project pins `yolov9` at `0.1` or runs `models/common.py` from a checkout of this repository
- Search the codebase for `DetectMultiBackend` and for loading of `.onnx` files from untrusted sources

## Fix

- unknown: the sources report that the project has not responded and name no patched version or workaround

## Timeline

- 2026-10-23T21:57:15+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111991

## From the sources

A security vulnerability has been detected in WongKinYiu yolov9 0.1. This vulnerability affects the function DetectMultiBackend.__init__ of the file models/common.py of the component ONNX Metadata Handler. The manipulation of the argument names/stride leads to code injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_