{"id":"CVE-2026-118618","kind":"vulnerability","aliases":["CVE-2026-118618"],"related":[],"title":"Ultralytics: unvalidated string in parse_model runs Python code","description":"Ultralytics parse_model Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parse_model function. The issue results from the lack of proper validation of a user-supplied string before using it to execute Python code. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-30121.","summary":"parse_model in Ultralytics (YOLO) executes a user-supplied string from a model config as Python code (ZDI-26-817, unpatched 0-day). Exposed: anyone using the ultralytics package who builds models from YAML configs they did not write (downloaded, community or user-uploaded). The victim must open a malicious file or page; code runs as that user. Teams loading only their own trusted configs can mostly skip it.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ultralytics","fixed":[],"affected":"unknown","ecosystem":"pypi"}],"ecosystems":[],"tags":["code-injection","computer-vision","package","python","ultralytics","user-interaction","yolo"],"not_affected_if":["trusted-configs-only","user-interaction-required"],"how_to_check":"Run 'pip show ultralytics': all versions presumed affected until a fix is announced. Check whether your code calls YOLO('<file>.yaml') or parse_model() on configs from outside your team.","fix":"No fixed release known as of 2026-10-28 (0-day; ZDI reports no vendor response). Watch github.com/ultralytics/ultralytics releases. Until then do not load untrusted model YAML/config files.","status":"open","published_at":"2026-10-28T17:18:28+00:00","first_seen_at":"2026-10-28T17:34:10+00:00","triaged_at":"2026-10-28T17:36:14+00:00","updated_at":"2026-10-28T17:38:32+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-28T17:36:14Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Ultralytics: unvalidated string in parse_model runs Python code","impact":"high","summary":"The parse_model function in Ultralytics does not validate a user-supplied string before executing it as Python code. An attacker who gets a victim to open a malicious file or visit a malicious page can run code as the current user.","category":"package","nicknames":[],"who_cares":["ultralytics","python","computer-vision"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker runs code as the user who opens the file","analyst_note":"Find the affected Ultralytics version range and fixed release in the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-118618) and the ZDI advisory for ZDI-CAN-30121.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["user-interaction-required"],"who_is_affected":"unknown","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000524,"input_tokens":3397,"output_tokens":369,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected Ultralytics version range and fixed release in the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-118618) and the ZDI advisory for ZDI-CAN-30121.","search":"'-118618':12A,15A '-2026':11A,14A '-26':49B '-817':50B '0':52B '30121':196C 'affect':119C 'allow':111C 'anyon':55B 'arbitrari':116C 'attack':113C,177C 'build':61B 'code':9A,18B,47B,85B,103C,106C,117C,175C,184C 'code-inject':17B 'communiti':71B 'comput':21B 'computer-vis':20B 'config':44B,65B,96B 'context':187C 'current':190C 'cve':10A,13A 'day':53B 'download':70B 'execut':35B,107C,115C,173C,183C 'exist':148C 'exploit':128C 'expos':54B 'file':82B,144C 'flaw':147C 'function':153C 'inject':19B,104C 'instal':120C 'interact':28B,124C 'issu':155C 'lack':159C 'leverag':179C 'load':91B 'malici':81B,138C,143C 'model':6A,31B,43B,62B,102C,152C 'most':98B 'must':78B,135C 'open':79B,141C 'packag':23B,59B 'page':84B,139C 'pars':5A,30B,101C,151C 'proper':161C 'python':8A,24B,46B,174C 'remot':105C,112C 'requir':126C 'result':156C 'run':7A,86B 'skip':99B 'specif':146C 'string':3A,40B,168C 'suppli':39B,167C 'target':134C 'team':90B 'trust':95B 'ultralyt':1A,25B,33B,58B,100C,122C 'ultralytics':16A 'unpatch':51B 'unvalid':2A 'upload':75B 'use':56B,170C 'user':27B,38B,74B,89B,123C,166C,191C 'user-interact':26B 'user-suppli':37B,165C 'user-upload':73B 'valid':162C 'victim':77B 'vision':22B 'visit':136C 'vulner':108C,110C,130C,181C 'within':149C 'write':69B 'yaml':64B 'yolo':29B,34B 'zdi':48B,194C 'zdi-can':193C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T17:18:28+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"zdi-disclosures@trendmicro.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118618","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118618","severity":null,"published_at":"2026-10-28T17:18:28+00:00","modified_at":"2026-10-28T17:18:28+00:00","first_seen_at":"2026-10-28T17:34:10+00:00","fetched_at":"2026-10-28T17:34:10+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-118618:970","url":null,"severity":null,"published_at":"2026-10-28T17:38:32+00:00","modified_at":"2026-10-28T17:38:32+00:00","first_seen_at":"2026-10-28T17:38:32+00:00","fetched_at":"2026-10-28T17:38:32+00:00","note":"ZDI-26-817 (0-day, published 2026-10-28, CVSS 7.8 AV:L/UI:R, credit Bongeun Koo) read; reported to vendor 2026-06-18, no vendor fix or affected range published; NVD page empty. Siblings CVE-2026-118613..118619 are other Ultralytics ZDI 0-days. A third-party HF PoC (Rodion111/yolo-config-poc) shows eval(act) in parse_model via YAML config, plausibly related but not confirmed as this CVE. who_is_affected flag not accepted by CLI; put in summary."}],"documents":[{"id":11641,"url":"https://www.zerodayinitiative.com/advisories/ZDI-26-817/","title":"ZDI-26-817 Ultralytics parse_model Code Injection (0Day)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}