CVE-2026-118616 in Ultralytics
Summary
by MITRE • 10/28/2026
Ultralytics parse_model Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the parse_model function. The issue results from the lack of proper validation of a user-supplied string before using it to execute Python code. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-30123.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/28/2026
The Ultralytics library, widely utilized for computer vision tasks including object detection and image segmentation via models such as YOLO, contains a critical security flaw within its model parsing logic that enables remote code execution. This vulnerability specifically resides in the parse_model function, which is responsible for interpreting configuration files or strings to instantiate neural network architectures. The core technical deficiency lies in the absence of rigorous input validation before these user-supplied strings are processed by Python's dynamic evaluation mechanisms. When an attacker provides a maliciously crafted string containing executable code snippets rather than standard model architecture definitions, the application fails to sanitize this input effectively. Consequently, the system interprets and executes arbitrary commands as if they were legitimate configuration directives, leading directly to remote code execution within the context of the user running the Ultralytics software.
From an operational perspective, this vulnerability poses a severe risk because it requires only minimal interaction from the victim, such as opening a malicious file or visiting a compromised webpage that triggers the parsing routine automatically in some contexts. Once exploited, an attacker gains full control over the underlying system processes associated with the current user account. This can lead to complete compromise of the host environment, including data exfiltration, installation of persistent backdoors, lateral movement within internal networks if connected systems are accessible, and potential denial of service through resource exhaustion or destructive commands. The severity is amplified by the popularity of Ultralytics in research and production environments where users frequently load models from untrusted sources or collaborate on shared datasets containing potentially malicious configuration artifacts.
This flaw aligns with CWE-94 Improper Control of Generation of Code, often referred to as code injection, specifically involving the use of dangerous functions like eval() or exec() without adequate sanitization of user input. In terms of adversary tactics and techniques, this vulnerability facilitates initial access through tricking users into executing malicious payloads, which maps closely to ATT&CK technique T1203 Exploitation for Client Execution if triggered via a client-side application, or potentially T1059 Command and Scripting Interpreter if the attacker leverages Python scripts post-exploitation. The lack of strict allow-listing for model architecture components allows attackers to bypass intended functionality boundaries and inject arbitrary logic into the execution flow.
Mitigation strategies must prioritize immediate updates to the latest version of Ultralytics where this parsing logic has been hardened with robust input validation and restricted evaluation scopes. Organizations should implement network segmentation to limit the blast radius in case of compromise and enforce strict code review practices for any custom integrations involving model loading from external sources. Additionally, deploying application whitelisting solutions can prevent unauthorized scripts or binaries from executing even if an attacker gains a foothold through this vulnerability. Security teams should also monitor for unusual process creation events related to Python interpreters spawning unexpected child processes when Ultralytics is in use, as this may indicate active exploitation attempts against unpatched systems.