CVE-2026-111212 in Medical-SAM-Adapter
Summary
by MITRE • 10/16/2026
A security flaw has been discovered in ImprintLab Medical-SAM-Adapter 0.1.0-alpha/0.1.0. Affected by this issue is the function session.get_modelmeta.custom_metadata_map of the file models/MobileSAMv2/ultralytics/nn/autobackend.py of the component AutoBackend Model Loading. The manipulation of the argument imgsz/names/kpt_shape results in improper neutralization of directives in dynamically evaluated code. The attack requires a local approach. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/16/2026
The ImprintLab Medical-SAM-Adapter, specifically versions 0.1.0-alpha and 0.1.0, contains a critical security vulnerability within its AutoBackend Model Loading component. This flaw resides in the session.get_modelmeta.custom_metadata_map function located in the models/MobileSAMv2/ultralytics/nn/autobackend.py file. The core issue is an improper neutralization of directives during dynamically evaluated code execution, which classifies this vulnerability under CWE-95 as a Command Injection flaw where user-supplied input is directly passed to a parser or interpreter without sufficient validation or escaping. This architectural weakness allows for the manipulation of specific arguments including imgsz, names, and kpt_shape, enabling an attacker to inject malicious commands that are executed within the context of the application process.
The technical mechanism behind this vulnerability relies on the dynamic evaluation capabilities inherent in Python-based machine learning frameworks like Ultralytics YOLO. When the AutoBackend component loads a model, it processes metadata associated with the model architecture. The function session.get_modelmeta.custom_metadata_map fails to properly sanitize inputs before they are processed by internal evaluators or executors. By manipulating parameters such as imgsz which defines image size, names for class labels, or kpt_shape for keypoint configurations, an attacker can craft payloads that break out of the intended data context and execute arbitrary code. This is a classic instance of insecure dynamic evaluation where trusted-looking inputs are treated as executable logic rather than pure data.
From an operational perspective, this vulnerability poses a severe risk to systems utilizing ImprintLab Medical-SAM-Adapter for medical imaging or other computer vision tasks. Although the attack vector requires local access, meaning the attacker must already have some level of authentication or physical proximity to the system, the impact is significant if achieved. Successful exploitation allows for remote code execution with the privileges of the user running the application. In a clinical or research environment where such software might be integrated into larger workflows involving sensitive patient data or critical infrastructure monitoring, this could lead to unauthorized access to confidential information, modification of diagnostic outputs, or complete compromise of the host system. The fact that an exploit has been released publicly further escalates the risk profile as it lowers the barrier for entry for less sophisticated attackers who may leverage automated tools rather than developing custom exploits from scratch.
The project maintainers were notified early via issue reports but have not yet issued a response or patch, leaving users exposed to this known threat. This lack of immediate remediation highlights the importance of proactive security measures by organizations deploying such software. Until an official fix is provided, mitigation strategies must focus on strict input validation and environment hardening. Administrators should ensure that any inputs passed to imgsz, names, or kpt_shape are strictly validated against a whitelist of expected formats and values rather than relying on the application's internal sanitization which has proven insufficient. Additionally running these services in isolated containers with minimal privileges can limit the blast radius if an exploitation attempt occurs. It is also advisable to monitor system logs for unusual process creation events that may indicate successful code injection attempts, particularly within processes related to ultralytics or model loading operations.