CVE-2026-111237 in FastSAM
Summary
by MITRE • 10/16/2026
A weakness has been identified in Ultralytics FastSAM up to b4ed20c2fed75eadc5aa7d8b09fedd137b873b52. This affects the function session.get_modelmeta.custom_metadata_map of the file ultralytics/nn/autobackend.py of the component AutoBackend Model Loading. This manipulation of the argument imgsz/names/kpt_shape causes improper neutralization of directives in dynamically evaluated code. The attack requires local access. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/16/2026
The identified vulnerability resides within the Ultralytics FastSAM library, specifically affecting versions up to commit b4ed20c2fed75eadc5aa7d8b09fedd137b873b52. The flaw is located in the session.get_modelmeta.custom_metadata_map function found in the ultralytics/nn/autobackend.py file, which handles AutoBackend Model Loading operations. This component is critical for initializing and configuring machine learning models within the FastSAM ecosystem, particularly when loading custom metadata or configuration parameters that dictate model behavior during inference tasks.
The core technical issue stems from improper neutralization of directives in dynamically evaluated code, a classic instance of CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code, commonly known as Server-Side Request Forgery (SSRF) if network requests are involved or Command Injection if system commands are executed. In this context, the vulnerability arises because user-supplied arguments such as imgsz (image size), names (class labels), and kpt_shape (keypoint shape) are not sufficiently sanitized before being processed by dynamic evaluation mechanisms like Python's eval() function or similar execution contexts within the metadata mapping logic. This lack of strict input validation allows an attacker to inject malicious code snippets that can be executed in the context of the running application process.
The operational impact of this vulnerability is significant for any deployment where FastSAM processes untrusted model configurations or custom metadata files provided by external sources. Although the attack vector requires local access, meaning a user must already have some level of authentication or file system access to trigger the flaw, the consequences can be severe within that constrained boundary. An attacker with local privileges could potentially achieve arbitrary code execution on the host machine running the FastSAM instance. This could lead to data exfiltration, modification of model weights, persistence mechanisms via backdoors in custom metadata, or lateral movement if the compromised system is part of a larger network infrastructure. The rolling release model employed by Ultralytics complicates mitigation efforts as specific version numbers for patched releases are not explicitly documented, requiring users to monitor commit logs directly rather than relying on traditional version-based patch management strategies.
From an offensive security perspective, this vulnerability aligns with ATT&CK technique T1059: Command and Scripting Interpreter, specifically regarding the use of dynamic evaluation features within programming languages like Python. It also relates to CWE-20: Improper Input Validation, as the root cause is the failure to validate or sanitize inputs before processing them in a security-sensitive context. The fact that the project was informed via an issue report but has not yet responded highlights a potential risk window where systems relying on this specific commit range remain exposed until upstream patches are applied and integrated into downstream distributions.
Mitigation strategies should focus on immediate operational controls since automatic patching is unavailable due to the rolling release nature of the software. Administrators should restrict file system permissions so that only trusted, internal users can provide custom metadata files or configuration inputs to the AutoBackend component. Implementing strict input validation at the application layer before passing imgsz, names, and kpt_shape parameters into the session.get_modelmeta function is essential; this includes whitelisting allowed values for image dimensions and keypoint shapes rather than accepting arbitrary strings. Additionally, running FastSAM instances with minimal privileges using containerization or sandboxed environments can limit the blast radius of a successful exploitation attempt. Organizations should also consider implementing monitoring solutions that detect unusual process executions or file access patterns associated with dynamic code evaluation within Python processes to identify potential exploitation attempts in real-time.