---
id: "CVE-2026-118616"
kind: "vulnerability"
aliases: ["CVE-2026-118616"]
title: "Ultralytics: crafted model config string runs attacker Python code"
severity: "high"
cvss: 7.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["computer-vision", "package", "python", "ultralytics"]
not_affected_if: []
published_at: "2026-10-28T17:18:28+00:00"
first_seen_at: "2026-10-28T17:34:10+00:00"
updated_at: "2026-10-28T17:36:23+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118616", "first_seen_at": "2026-10-28T17:34:10+00:00"}]
---

# Ultralytics: crafted model config string runs attacker Python code

The parse_model function in Ultralytics runs a user-supplied string as Python code without validating it. An attacker who gets a victim to open a malicious file or visit a malicious page can run code as that user.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `pip show ultralytics` to read the installed version; the sources do not list affected versions, so unknown whether a given version is vulnerable.

## Timeline

- 2026-10-28T17:34:10+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118616

## From the sources

Ultralytics parse_model Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parse_model function. The issue results from the lack of proper validation of a user-supplied string before using it to execute Python code. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-30123.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_