{"id":"CVE-2026-118615","kind":"vulnerability","aliases":["CVE-2026-118615"],"related":[],"title":"Ultralytics: command injection in torch_safe_load runs code on open","description":"Ultralytics torch_safe_load Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the torch_safe_load function. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-30122.","summary":"The torch_safe_load function in Ultralytics passes a user-supplied string into a system call without validating it. An attacker who gets a user to open a malicious file or visit a malicious page can run code as that user.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["computer-vision","package","python","ultralytics"],"not_affected_if":["no-untrusted-input"],"how_to_check":"- Check the installed Ultralytics version with `pip show ultralytics`\n- Search your code and notebooks for calls to `torch_safe_load` and note where its input comes from\n- unknown for a definitive check beyond this","fix":"- Upgrade the ultralytics package to a fixed release; the fixed version is unknown from the sources\n- Until patched, do not pass untrusted files or strings to `torch_safe_load`","status":"open","published_at":"2026-10-28T17:18:28+00:00","first_seen_at":"2026-10-28T17:34:10+00:00","triaged_at":"2026-10-28T17:36:20+00:00","updated_at":"2026-10-28T17:36:20+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-28T17:36:20Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the ultralytics package to a fixed release; the fixed version is unknown from the sources\n- Until patched, do not pass untrusted files or strings to `torch_safe_load`","reach":"unknown","title":"Ultralytics: command injection in torch_safe_load runs code on open","impact":"high","summary":"The torch_safe_load function in Ultralytics passes a user-supplied string into a system call without validating it. An attacker who gets a user to open a malicious file or visit a malicious page can run code as that user.","category":"package","nicknames":[],"who_cares":["python","ultralytics","computer-vision"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker runs arbitrary code as the current user","analyst_note":"Find the affected version range and fixed release in the NVD entry or the ZDI advisory (ZDI-CAN-30122).","how_to_check":"- Check the installed Ultralytics version with `pip show ultralytics`\n- Search your code and notebooks for calls to `torch_safe_load` and note where its input comes from\n- unknown for a definitive check beyond this","needs_analyst":true,"not_affected_if":["no-untrusted-input"],"who_is_affected":"Teams that run Ultralytics and let the torch_safe_load path handle files or strings from outside users, such as uploaded model files or user-supplied paths. Systems that only load trusted, locally built models are less exposed. The sources do not name the affected version range.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000613,"input_tokens":3406,"output_tokens":545,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-118615':14A,17A '-2026':13A,16A '30122':165C 'affect':86C 'allow':78C 'arbitrari':83C 'attack':45B,80C,146C 'call':40B,144C 'code':9A,62B,73C,84C,153C 'command':2A,70C 'comput':19B 'computer-vis':18B 'context':156C 'current':159C 'cve':12A,15A 'execut':74C,82C,141C,152C 'exist':115C 'exploit':95C 'file':54B,111C 'flaw':114C 'function':28B,121C 'get':47B 'inject':3A,71C 'instal':87C 'interact':91C 'issu':123C 'lack':127C 'leverag':148C 'load':7A,27B,69C,120C 'malici':53B,58B,105C,110C 'must':102C 'open':11A,51B,108C 'packag':21B 'page':59B,106C 'pass':31B 'proper':129C 'python':22B 'remot':72C,79C 'requir':93C 'result':124C 'run':8A,61B 'safe':6A,26B,68C,119C 'specif':113C 'string':36B,136C 'suppli':35B,135C 'system':39B,143C 'target':101C 'torch':5A,25B,67C,118C 'ultralyt':1A,23B,30B,66C,89C 'use':138C 'user':34B,49B,65B,90C,134C,160C 'user-suppli':33B,133C 'valid':42B,130C 'vision':20B 'visit':56B,103C 'vulner':75C,77C,97C,150C 'within':116C 'without':41B 'zdi':163C 'zdi-can':162C","nicknames":[],"mitigations":[],"who_affected":"Teams that run Ultralytics and let the torch_safe_load path handle files or strings from outside users, such as uploaded model files or user-supplied paths. Systems that only load trusted, locally built models are less exposed. The sources do not name the affected version range.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T17:18:28+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"zdi-disclosures@trendmicro.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118615","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118615","severity":null,"published_at":"2026-10-28T17:18:28+00:00","modified_at":"2026-10-28T17:18:28+00:00","first_seen_at":"2026-10-28T17:34:10+00:00","fetched_at":"2026-10-28T17:34:10+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}