Live › vulnerability › CVE-2026-118614
Go to dashboardThe check_det_dataset function in Ultralytics passes a user-supplied string to Python code execution without validation. An attacker who gets a user to open a malicious file or visit a malicious page can run code as that user.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 17:34 UTC. All times on this page are UTC.
Teams that run Ultralytics YOLO tooling on workstations or servers and load dataset configuration supplied from outside the team could be exposed. The sources do not name affected versions or the exact data path. Teams that never load untrusted dataset files have less exposure.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Ultralytics check_det_dataset Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the check_det_dataset function. The issue results from the lack of proper validation of a user-supplied string before using it to execute Python code. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-30119.
This page as .md · .json · in your agent: get_signal("CVE-2026-118614")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.