CVE-2026-111991 in yolov9
Summary
by MITRE • 10/18/2026
A security vulnerability has been detected in WongKinYiu yolov9 0.1. This vulnerability affects the function DetectMultiBackend.__init__ of the file models/common.py of the component ONNX Metadata Handler. The manipulation of the argument names/stride leads to code injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/19/2026
The vulnerability identified in WongKinYiu yolov9 version 0.1 represents a critical security flaw within the ONNX Metadata Handler component, specifically located in the DetectMultiBackend._init_ function found in models/common.py. This defect arises from improper validation and sanitization of input arguments, particularly those related to argument names and stride parameters. When an attacker provides maliciously crafted inputs for these parameters, the application fails to adequately sanitize them before processing. Consequently, this lack of rigorous input handling allows for arbitrary code injection, enabling an adversary to execute unintended commands within the context of the running process. The presence of such a flaw in a widely used deep learning framework significantly elevates the risk profile, as model inference engines are often deployed in production environments where they handle sensitive data or serve critical AI-driven services.
From a technical perspective, this vulnerability is classified under CWE-94 Improper Control of Generation of Code (Code Injection). The root cause lies in the dynamic evaluation or execution mechanisms inherent to Python-based machine learning libraries when processing metadata from ONNX models. If the stride or argument names are manipulated to include malicious payloads that bypass existing checks, they can be interpreted as executable code rather than mere configuration parameters. This behavior aligns with ATT&CK technique T1059 Command and Scripting Interpreter, where attackers leverage built-in system tools or interpreters to execute commands. The ability to inject code through model metadata is particularly dangerous because it allows for remote exploitation without requiring direct access to the underlying operating system shell initially. Attackers can embed these malicious payloads within standard ONNX files, which are commonly exchanged and deployed across various platforms, thereby increasing the attack surface significantly.
The operational impact of this vulnerability is severe due to its potential for remote code execution. Since the exploit has been disclosed publicly, automated scanning tools and threat actors can readily identify vulnerable instances in the wild. An attacker who successfully exploits this flaw could gain full control over the host system running the yolov9 inference engine. This could lead to data exfiltration, lateral movement within a network, or the establishment of persistent backdoors. Given that deep learning models are increasingly integrated into automated pipelines and cloud services, the compromise of such systems can disrupt critical operations and expose proprietary algorithms or training data. The fact that the project maintainers have not yet responded to early issue reports exacerbates this risk, leaving users without official patches or guidance on how to mitigate the exposure in the short term.
To mitigate these risks, immediate defensive measures should be implemented by organizations deploying yolov9 models. First and foremost, it is advisable to avoid loading untrusted ONNX files from unknown sources until a patched version of the library is released. If external model ingestion is necessary, strict sandboxing techniques should be employed to isolate the inference process from the host environment. This includes running the application within containers with restricted privileges or using virtualization technologies that limit the blast radius in case of exploitation. Additionally, input validation layers can be added at the application level to filter out suspicious characters or patterns in metadata fields before they reach the DetectMultiBackend initialization routine. Monitoring system logs for unusual process creation events associated with Python interpreters can also aid in early detection of attempted exploits. Until a formal patch is available by the project maintainers, these compensating controls are essential to reduce the likelihood of successful remote code execution attacks targeting this specific vulnerability.