CVE-2026-118618 in Ultralytics
Summary
by MITRE • 10/28/2026
Ultralytics parse_model Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the parse_model function. The issue results from the lack of proper validation of a user-supplied string before using it to execute Python code. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-30121.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/28/2026
The Ultralytics library, widely utilized for computer vision tasks including object detection and image segmentation via models such as YOLO, contains a critical security flaw within its model parsing logic that enables remote code execution. This vulnerability stems from the parse_model function which is responsible for interpreting configuration files or strings to instantiate neural network architectures. The core technical deficiency lies in the absence of rigorous input validation before these user-supplied strings are processed by Python's dynamic evaluation mechanisms, such as eval() or exec(), or through unsafe deserialization practices inherent in how certain model definitions are constructed. By failing to sanitize inputs that dictate module instantiation parameters, the application inadvertently allows an attacker to inject arbitrary Python code snippets into the execution context of the host system.
Exploitation of this vulnerability requires user interaction because it typically involves tricking a victim into opening a maliciously crafted configuration file or visiting a web page that triggers the loading of a compromised model definition. Once triggered, the parser processes the injected payload as if it were legitimate architectural instructions. This allows an attacker to execute arbitrary commands with the privileges of the current user running the Ultralytics application. The impact is severe, potentially leading to full system compromise, data exfiltration, or lateral movement within a network environment where such machine learning tools are deployed for inference or training tasks.
From a classification perspective, this vulnerability aligns closely with CWE-94 Improper Control of Generation of Code (Code Injection) and specifically CWE-502 Deserialization of Untrusted Data if the input mechanism involves serialized objects. In terms of adversary tactics, it maps to MITRE ATT&CK technique T1059 Command and Scripting Interpreter, where attackers use scripting languages like Python to execute commands on a target system. The lack of allow-listing for module names or parameters is a common pattern in such flaws, highlighting the danger of using dynamic code generation without strict constraints on allowed inputs.
Mitigation strategies must focus on implementing strict input validation and avoiding unsafe evaluation methods entirely. Developers should replace any use of eval() or exec() with safer alternatives that parse configuration data into structured objects rather than executing raw strings. Implementing an allow-list for permitted module names and parameter types can prevent the injection of malicious code paths. Additionally, running applications with minimal privileges limits the potential damage if exploitation occurs. For users relying on existing versions, updating to a patched release is essential, as Ultralytics has addressed this issue by hardening the parse_model function against untrusted input manipulation.