---
id: "CVE-2026-118615"
kind: "vulnerability"
aliases: ["CVE-2026-118615"]
title: "Ultralytics: command injection in torch_safe_load runs code on open"
severity: "high"
cvss: 7.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["computer-vision", "package", "python", "ultralytics"]
not_affected_if: ["no-untrusted-input"]
published_at: "2026-10-28T17:18:28+00:00"
first_seen_at: "2026-10-28T17:34:10+00:00"
updated_at: "2026-10-28T17:36:20+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118615", "first_seen_at": "2026-10-28T17:34:10+00:00"}]
---

# Ultralytics: command injection in torch_safe_load runs code on open

The torch_safe_load function in Ultralytics passes a user-supplied string into a system call without validating it. An attacker who gets a user to open a malicious file or visit a malicious page can run code as that user.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Ultralytics version with `pip show ultralytics`
- Search your code and notebooks for calls to `torch_safe_load` and note where its input comes from
- unknown for a definitive check beyond this

## Fix

- Upgrade the ultralytics package to a fixed release; the fixed version is unknown from the sources
- Until patched, do not pass untrusted files or strings to `torch_safe_load`

## Timeline

- 2026-10-28T17:34:10+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118615

## From the sources

Ultralytics torch_safe_load Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the torch_safe_load function. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-30122.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_