{"id":"CVE-2026-118614","kind":"vulnerability","aliases":["CVE-2026-118614"],"related":[],"title":"Ultralytics: unvalidated dataset string lets a file run Python code","description":"Ultralytics check_det_dataset Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the check_det_dataset function. The issue results from the lack of proper validation of a user-supplied string before using it to execute Python code. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-30119.","summary":"The check_det_dataset function in Ultralytics passes a user-supplied string to Python code execution without validation. An attacker who gets a user to open a malicious file or visit a malicious page can run code as that user.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["computer-vision","package","python","ultralytics"],"not_affected_if":["no-untrusted-datasets"],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-28T17:18:28+00:00","first_seen_at":"2026-10-28T17:34:10+00:00","triaged_at":"2026-10-28T17:36:20+00:00","updated_at":"2026-10-28T17:36:20+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-28T17:36:20Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"unknown","title":"Ultralytics: unvalidated dataset string lets a file run Python code","impact":"high","summary":"The check_det_dataset function in Ultralytics passes a user-supplied string to Python code execution without validation. An attacker who gets a user to open a malicious file or visit a malicious page can run code as that user.","category":"package","nicknames":[],"who_cares":["ultralytics","python","computer-vision"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker runs code as the current user on the machine","analyst_note":"Find affected Ultralytics versions, the fixed release and the exact dataset input path from the NVD entry and the ZDI advisory (ZDI-CAN-30119).","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["no-untrusted-datasets"],"who_is_affected":"Teams that run Ultralytics YOLO tooling on workstations or servers and load dataset configuration supplied from outside the team could be exposed. The sources do not name affected versions or the exact data path. Teams that never load untrusted dataset files have less exposure.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000559,"input_tokens":3406,"output_tokens":437,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-118614':13A,16A '-2026':12A,15A '30119':162C 'affect':84C 'allow':76C 'arbitrari':81C 'attack':43B,78C,143C 'check':24B,65C,116C 'code':10A,38B,60B,68C,71C,82C,141C,150C 'comput':18B 'computer-vis':17B 'context':153C 'current':156C 'cve':11A,14A 'dataset':3A,26B,67C,118C 'det':25B,66C,117C 'execut':39B,72C,80C,139C,149C 'exist':113C 'exploit':93C 'file':7A,52B,109C 'flaw':112C 'function':27B,119C 'get':45B 'inject':69C 'instal':85C 'interact':89C 'issu':121C 'lack':125C 'let':5A 'leverag':145C 'malici':51B,56B,103C,108C 'must':100C 'open':49B,106C 'packag':20B 'page':57B,104C 'pass':30B 'proper':127C 'python':9A,21B,37B,140C 'remot':70C,77C 'requir':91C 'result':122C 'run':8A,59B 'specif':111C 'string':4A,35B,134C 'suppli':34B,133C 'target':99C 'ultralyt':1A,22B,29B,64C,87C 'unvalid':2A 'use':136C 'user':33B,47B,63B,88C,132C,157C 'user-suppli':32B,131C 'valid':41B,128C 'vision':19B 'visit':54B,101C 'vulner':73C,75C,95C,147C 'within':114C 'without':40B 'zdi':160C 'zdi-can':159C","nicknames":[],"mitigations":[],"who_affected":"Teams that run Ultralytics YOLO tooling on workstations or servers and load dataset configuration supplied from outside the team could be exposed. The sources do not name affected versions or the exact data path. Teams that never load untrusted dataset files have less exposure.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T17:18:28+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"zdi-disclosures@trendmicro.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118614","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118614","severity":null,"published_at":"2026-10-28T17:18:28+00:00","modified_at":"2026-10-28T17:18:28+00:00","first_seen_at":"2026-10-28T17:34:10+00:00","fetched_at":"2026-10-28T17:34:10+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}