Submit #997729: iMoonLab up to main commit 73289949533efac82bb5f72ec19b746618656bd2 Code Injection (CWE-94)

A vulnerability was found in yolov13 up to main commit 73289949533efac82bb5f72ec19b746618656bd2 and classified as high 7.8. Affected is the vendored ultralytics AutoBackend model-loading component (ultralytics/nn/autobackend.py). The manipulation of the ONNX metadata_props imgsz/names/kpt_shape strings leads to code injection. The attack is launched locally: the victim has to load an attacker-supplied .onnx model file.

Technical Details
- Affected file/function (verified at the current default branch 73289949533efac82bb5f72ec19b746618656bd2 on 2026-09-24):
ultralytics/nn/autobackend.py:220 reads the model file's own custom_metadata_map via session.get_modelmeta(); ultralytics/nn/autobackend.py:481 passes the imgsz/names/kpt_shape values through eval(). There is no validation, allowlist or sandbox between the two; the evaluation runs before any inference call, and no opt-in exists. check_class_names() inspects only the result after the sink and cannot prevent execution. The same file already uses ast.literal_eval for its TFLite metadata branch; an external metadata.yaml sidecar next to the weights reaches the same loop as a second channel.
- Vulnerable parameter: metadata_props entries imgsz/names/kpt_shape (an arbitrary string-to-string map) inside an .onnx file, and optionally a metadata.yaml sidecar next to the weights
- Attack vector: Local
- Privileges required: None
- Trigger condition: loading the model file is sufficient - the sink is inside AutoBackend.__init__, before any inference. Rewriting metadata_props requires no signing key and leaves the file loading and inferring normally.
- Origin of the weakness: this repository vendors ultralytics 8.3.63. The vendored tree is a lightly customised 8.3.63: a git blob-SHA comparison against upstream tag v8.3.63 (2026-09-24) shows 215 of 232 package files byte-identical, 17 files modified (training/augmentation plumbing) and 2 added (yolov12/v13 model configs). `nn/autobackend.py` — the file containing the sink — is byte-identical to upstream v8.3.63, so the upstream one-line fix applies verbatim without touching this repository's own changes. The upstream ultralytics project replaced the eval() with ast.literal_eval() in release v8.3.234 (commit 265b92fa084e05f54eb5d2dc18eafcd056e23457, PR #22847, 2025-12-01). The copy vendored here predates that release: the exposure arises from the dependency on the vulnerable ultralytics version (CWE-1395), with the underlying defect being CWE-95 (eval injection, parent CWE-94) delivered via an untrusted model file (CWE-502).
- Validation: the import of bundle-controlled code was reproduced end to end through this repository's original, byte-verified AutoBackend sources in an air-gapped container (--network none), driven by a locally generated .onnx carrying deliberately harmless sentinel metadata strings (integer constants); the parsed imgsz value could only have been produced by eval() of the stored string, and a pristine-copy negative control produced no sentinel.

Impact
- Confidentiality: High (the evaluated expression runs with unrestricted builtins in the loading process, which typically holds dataset mounts, checkpoints and credentials)
- Integrity: High (the same reach applies to writing model files, checkpoints and working-tree source)
- Availability: High (the expression can terminate or hang the process, or delete what it can write)

CVSS v3.1
Score: 7.8 (High)
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Timeline
- Discovered: 2026-09-18
- Vendor notified: 2026-09-24 (issue <NUM> opened; mechanism and fix guidance only, harmless sentinel used in validation, no exploit attached)
- Patch released: [pending]
- Public disclosure: 2026-09-24 (issue <NUM> published; exploit not released)

Countermeasure
cherry-pick the upstream one-liner commit 265b92fa: replace eval(v) with ast.literal_eval(v) at ultralytics/nn/autobackend.py:481 (ast is already imported in that file). Optional hardening: fail soft with try/except and default fallback; validate the parsed structure; apply the same handling to the external metadata.yaml branch.

• Quelle: ⚠️ https://github.com/iMoonLab/yolov13/issues/81
• Benutzer: dem0000 (UID 98390)
• Einreichung: 24.09.2026 16:13 (vor 1 Monat)
• Moderieren: 11.10.2026 20:55 (17 days later)
• Status: Akzeptiert
• VulDB Eintrag: 416770 [iMoonLab yolov13 bis 73289949533efac82bb5f72ec19b746618656bd2 AutoBackend Model Loading autobackend.py eval imgsz/names/kpt_shape erweiterte Rechte]
• Punkte: 20