CVE-2026-118615 in Ultralytics
Summary
by MITRE • 10/28/2026
Ultralytics torch_safe_load Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the torch_safe_load function. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-30122.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/28/2026
The Ultralytics library, widely utilized for computer vision tasks including object detection and image segmentation via PyTorch implementations, contains a critical security flaw within its model loading mechanism. Specifically, the torch_safe_load function exhibits an improper input validation vulnerability that enables remote code execution under specific conditions. This issue stems from the application's failure to adequately sanitize or validate user-supplied strings before they are processed in contexts where system-level operations may be triggered. The vulnerability was tracked as ZDI-CAN-30122 and represents a significant risk for applications relying on Ultralytics for loading pre-trained models, particularly when those model files originate from untrusted sources.
The technical root cause of this vulnerability lies in the handling of serialized data within the torch_safe_load function. When an application attempts to load a PyTorch model file, it typically unpickles or parses the file contents. In this specific implementation, if the input string is not strictly validated against expected formats and allowed characters, malicious payloads embedded within the file structure can be executed during the loading process. This lack of validation allows an attacker who controls the content of a model file to inject arbitrary commands that are then interpreted by the underlying system or Python environment. The flaw essentially bypasses security boundaries intended to isolate data processing from code execution, turning what should be passive data ingestion into an active attack vector for remote code execution.
From an operational perspective, this vulnerability poses severe risks because it allows attackers to execute arbitrary code in the context of the current user running the Ultralytics application. If a victim is tricked into opening a malicious model file or visiting a webpage that triggers the loading of such a file through a web-based interface utilizing Ultralytics, the attacker gains full control over the affected system. The impact includes potential data theft, modification of critical files, installation of malware, and use of the compromised host as a pivot point for further network attacks. Since user interaction is required to exploit this vulnerability in most scenarios, such as opening a file or visiting a malicious page, it relies on social engineering tactics or compromised distribution channels rather than purely automated remote exploitation without any human action.
This type of flaw aligns with CWE-78 Improper Neutralization of Special Elements used in an OS Command and CWE-94 Improper Control of Generation of Code often referred to as code injection. In the context of the MITRE ATT&CK framework, this vulnerability facilitates techniques associated with Execution via User Interaction and potentially Defense Evasion if the attacker uses the compromised system to hide their presence or escalate privileges further. The requirement for user interaction classifies it under attack vectors that depend on human behavior rather than purely technical exploitation chains, although the severity remains high due to the potential for complete system compromise once triggered.
Mitigation strategies must focus on both immediate remediation and long-term architectural improvements. Users of Ultralytics should immediately update to the latest patched version where this validation logic has been corrected. In environments where updating is not immediately feasible, it is critical to implement strict allow-listing for model file sources and avoid loading files from untrusted or unknown origins. Additionally, running applications that utilize Ultralytics with minimal privileges can limit the impact of a successful exploitation attempt by restricting what an attacker can do even if they achieve code execution. Security teams should also monitor for unusual process creation events originating from Python processes associated with computer vision tasks as part of their threat detection strategies.