---
id: "CVE-2026-118618"
kind: "vulnerability"
aliases: ["CVE-2026-118618"]
title: "Ultralytics: unvalidated string in parse_model runs Python code"
severity: "high"
cvss: 7.8
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "ultralytics", "fixed": [], "affected": "unknown", "ecosystem": "pypi"}]
ecosystems: []
tags: ["code-injection", "computer-vision", "package", "python", "ultralytics", "user-interaction", "yolo"]
not_affected_if: ["trusted-configs-only", "user-interaction-required"]
published_at: "2026-10-28T17:18:28+00:00"
first_seen_at: "2026-10-28T17:34:10+00:00"
updated_at: "2026-10-28T17:38:32+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118618", "first_seen_at": "2026-10-28T17:34:10+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-28T17:38:32+00:00"}]
---

# Ultralytics: unvalidated string in parse_model runs Python code

parse_model in Ultralytics (YOLO) executes a user-supplied string from a model config as Python code (ZDI-26-817, unpatched 0-day). Exposed: anyone using the ultralytics package who builds models from YAML configs they did not write (downloaded, community or user-uploaded). The victim must open a malicious file or page; code runs as that user. Teams loading only their own trusted configs can mostly skip it.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pypi:ultralytics affected unknown fixed ?

## How to check

Run 'pip show ultralytics': all versions presumed affected until a fix is announced. Check whether your code calls YOLO('<file>.yaml') or parse_model() on configs from outside your team.

## Fix

No fixed release known as of 2026-10-28 (0-day; ZDI reports no vendor response). Watch github.com/ultralytics/ultralytics releases. Until then do not load untrusted model YAML/config files.

## Timeline

- 2026-10-28T17:34:10+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118618
- 2026-10-28T17:38:32+00:00 analyst — ZDI-26-817 (0-day, published 2026-10-28, CVSS 7.8 AV:L/UI:R, credit Bongeun Koo) read; reported to vendor 2026-06-18, no vendor fix or affected range published; NVD page empty. Siblings CVE-2026-118613..118619 are other Ultralytics ZDI 0-days. A third-party HF PoC (Rodion111/yolo-config-poc) shows eval(act) in parse_model via YAML config, plausibly related but not confirmed as this CVE. who_is_affected flag not accepted by CLI; put in summary.

## Documents

- [advisory] ZDI-26-817 Ultralytics parse_model Code Injection (0Day) https://www.zerodayinitiative.com/advisories/ZDI-26-817/

## From the sources

Ultralytics parse_model Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parse_model function. The issue results from the lack of proper validation of a user-supplied string before using it to execute Python code. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-30121.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_