Submit #1004883: THU-MIG yoloe up to main commit 40cd606cabdbe2b566d6f14a6b162c89206e9a1b (vendors ultralytics 8.3.39) Code Injection

A vulnerability was found in yoloe up to main commit 40cd606cabdbe2b566d6f14a6b162c89206e9a1b and classified as high 7.8. Affected is the vendored ultralytics AutoBackend model-loading component (ultralytics/nn/autobackend.py). The manipulation of the ONNX metadata_props imgsz/names/kpt_shape strings leads to code injection. The attack is launched locally: the victim has to load an attacker-supplied .onnx model file.

Technical Details
- Affected file/function (verified at the current default branch 40cd606cabdbe2b566d6f14a6b162c89206e9a1b on 2026-09-24):
ultralytics/nn/autobackend.py:220 reads the model file's own custom_metadata_map via session.get_modelmeta(); ultralytics/nn/autobackend.py:483 passes the imgsz/names/kpt_shape values through eval(). There is no validation, allowlist or sandbox between the two; the evaluation runs before any inference call, and no opt-in exists. check_class_names() inspects only the result after the sink and cannot prevent execution. The same file already uses ast.literal_eval for its TFLite metadata branch; an external metadata.yaml sidecar next to the weights reaches the same loop as a second channel.
- Vulnerable parameter: metadata_props entries imgsz/names/kpt_shape (an arbitrary string-to-string map) inside an .onnx file, and optionally a metadata.yaml sidecar next to the weights
- Attack vector: Local
- Privileges required: None
- Trigger condition: loading the model file is sufficient - the sink is inside AutoBackend.__init__, before any inference. Rewriting metadata_props requires no signing key and leaves the file loading and inferring normally.
- Origin of the weakness: this repository vendors ultralytics 8.3.39. The vendored tree is a customised 8.3.39: a git blob-SHA comparison against upstream tag v8.3.39 (2026-09-24) shows 195 of 228 package files byte-identical, 28 modified (engine/data pipeline) and 28 added (YOLOE configs/assets). `nn/autobackend.py` — the file containing the sink — is byte-identical to upstream v8.3.39, so the upstream one-line fix applies verbatim without touching this repository's own changes. The upstream ultralytics project replaced the eval() with ast.literal_eval() in release v8.3.234 (commit 265b92fa084e05f54eb5d2dc18eafcd056e23457, PR #22847, 2025-12-01). The copy vendored here predates that release: the exposure arises from the dependency on the vulnerable ultralytics version (CWE-1395), with the underlying defect being CWE-95 (eval injection, parent CWE-94) delivered via an untrusted model file (CWE-502).
- Validation: code-level verification at this repository's HEAD (source and sink lines re-read live); the identical defect was executed end to end on a sibling vendored copy of the same lineage (iMoonLab/yolov13) in an air-gapped container with harmless sentinel metadata strings and a negative control.

Impact
- Confidentiality: High (the evaluated expression runs with unrestricted builtins in the loading process, which typically holds dataset mounts, checkpoints and credentials)
- Integrity: High (the same reach applies to writing model files, checkpoints and working-tree source)
- Availability: High (the expression can terminate or hang the process, or delete what it can write)

CVSS v3.1
Score: 7.8 (High)
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

• Quelle: ⚠️ https://github.com/THU-MIG/yoloe/issues/148
• Benutzer: Dem00000 (UID 98563)
• Einreichung: 29.09.2026 10:03 (vor 18 Tagen)
• Moderieren: 17.10.2026 09:09 (18 days later)
• Status: Akzeptiert
• VulDB Eintrag: 421573 [THU-MIG yoloe bis 40cd606cabdbe2b566d6f14a6b162c89206e9a1b AutoBackend Model Loading autobackend.py eval imgsz/names/kpt_shape Local Privilege Escalation]
• Punkte: 20