{"id":"CVE-2026-118616","kind":"vulnerability","aliases":["CVE-2026-118616"],"related":[],"title":"Ultralytics: crafted model config string runs attacker Python code","description":"Ultralytics parse_model Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parse_model function. The issue results from the lack of proper validation of a user-supplied string before using it to execute Python code. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-30123.","summary":"The parse_model function in Ultralytics runs a user-supplied string as Python code without validating it. An attacker who gets a victim to open a malicious file or visit a malicious page can run code as that user.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["computer-vision","package","python","ultralytics"],"not_affected_if":[],"how_to_check":"- Run `pip show ultralytics` to read the installed version; the sources do not list affected versions, so unknown whether a given version is vulnerable.","fix":null,"status":"open","published_at":"2026-10-28T17:18:28+00:00","first_seen_at":"2026-10-28T17:34:10+00:00","triaged_at":"2026-10-28T17:36:23+00:00","updated_at":"2026-10-28T17:36:23+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-28T17:36:23Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Ultralytics: crafted model config string runs attacker Python code","impact":"high","summary":"The parse_model function in Ultralytics runs a user-supplied string as Python code without validating it. An attacker who gets a victim to open a malicious file or visit a malicious page can run code as that user.","category":"package","nicknames":[],"who_cares":["ultralytics","python","computer-vision"],"confidence":0.6,"needs_auth":"no","worst_case":"Code runs as the current user after a malicious file is opened","analyst_note":"","how_to_check":"- Run `pip show ultralytics` to read the installed version; the sources do not list affected versions, so unknown whether a given version is vulnerable.","needs_analyst":false,"not_affected_if":[],"who_is_affected":"Teams that load model configurations or other user-supplied input through Ultralytics' parse_model path could be exposed, since the flaw is in how that input is turned into executed code. The sources do not say which versions or deployment patterns are affected, so unknown whether systems that only load trusted local models are exempt.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000918,"input_tokens":3397,"output_tokens":1157,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-118616':12A,15A '-2026':11A,14A '30123':158C 'affect':81C 'allow':73C 'arbitrari':78C 'attack':7A,41B,75C,139C 'code':9A,36B,58B,65C,68C,79C,137C,146C 'comput':17B 'computer-vis':16B 'config':4A 'context':149C 'craft':2A 'current':152C 'cve':10A,13A 'execut':69C,77C,135C,145C 'exist':110C 'exploit':90C 'file':50B,106C 'flaw':109C 'function':25B,115C 'get':43B 'inject':66C 'instal':82C 'interact':86C 'issu':117C 'lack':121C 'leverag':141C 'malici':49B,54B,100C,105C 'model':3A,24B,64C,114C 'must':97C 'open':47B,103C 'packag':19B 'page':55B,101C 'pars':23B,63C,113C 'proper':123C 'python':8A,20B,35B,136C 'remot':67C,74C 'requir':88C 'result':118C 'run':6A,28B,57B 'specif':108C 'string':5A,33B,130C 'suppli':32B,129C 'target':96C 'ultralyt':1A,21B,27B,62C,84C 'use':132C 'user':31B,61B,85C,128C,153C 'user-suppli':30B,127C 'valid':38B,124C 'victim':45B 'vision':18B 'visit':52B,98C 'vulner':70C,72C,92C,143C 'within':111C 'without':37B 'zdi':156C 'zdi-can':155C","nicknames":[],"mitigations":[],"who_affected":"Teams that load model configurations or other user-supplied input through Ultralytics' parse_model path could be exposed, since the flaw is in how that input is turned into executed code. The sources do not say which versions or deployment patterns are affected, so unknown whether systems that only load trusted local models are exempt.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T17:18:28+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"zdi-disclosures@trendmicro.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118616","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118616","severity":null,"published_at":"2026-10-28T17:18:28+00:00","modified_at":"2026-10-28T17:18:28+00:00","first_seen_at":"2026-10-28T17:34:10+00:00","fetched_at":"2026-10-28T17:34:10+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}