提出 #1004882: CASIA-LMC-Lab FastSAM up to main commit b4ed20c2fed75eadc5aa7d8b09fedd137b873b52 (vendors ultralytics 8.0.120) Code Injection

A vulnerability was found in FastSAM up to main commit b4ed20c2fed75eadc5aa7d8b09fedd137b873b52 and classified as high 7.8. Affected is the vendored ultralytics AutoBackend model-loading component (ultralytics/nn/autobackend.py). The manipulation of the ONNX metadata_props imgsz/names/kpt_shape strings leads to code injection. The attack is launched locally: the victim has to load an attacker-supplied .onnx model file.

Technical Details
- Affected file/function (verified at the current default branch b4ed20c2fed75eadc5aa7d8b09fedd137b873b52 on 2026-09-24):
ultralytics/nn/autobackend.py:132 reads the model file's own custom_metadata_map via session.get_modelmeta(); ultralytics/nn/autobackend.py:278 passes the imgsz/names/kpt_shape values through eval(). There is no validation, allowlist or sandbox between the two; the evaluation runs before any inference call, and no opt-in exists. check_class_names() inspects only the result after the sink and cannot prevent execution. The same file already uses ast.literal_eval for its TFLite metadata branch; an external metadata.yaml sidecar next to the weights reaches the same loop as a second channel.
- Vulnerable parameter: metadata_props entries imgsz/names/kpt_shape (an arbitrary string-to-string map) inside an .onnx file, and optionally a metadata.yaml sidecar next to the weights
- Attack vector: Local
- Privileges required: None
- Trigger condition: loading the model file is sufficient - the sink is inside AutoBackend.__init__, before any inference. Rewriting metadata_props requires no signing key and leaves the file loading and inferring normally.
- Origin of the weakness: this repository vendors ultralytics 8.0.120. The vendored tree is nearly stock 8.0.120: a git blob-SHA comparison against upstream tag v8.0.120 (2026-09-24) shows 159 of 161 package files byte-identical, 1 file modified (`yolo/utils/ops.py`). `nn/autobackend.py` — the file containing the sink — is byte-identical to upstream v8.0.120, so the upstream one-line fix applies verbatim. The upstream ultralytics project replaced the eval() with ast.literal_eval() in release v8.3.234 (commit 265b92fa084e05f54eb5d2dc18eafcd056e23457, PR #22847, 2025-12-01). The copy vendored here predates that release: the exposure arises from the dependency on the vulnerable ultralytics version (CWE-1395), with the underlying defect being CWE-95 (eval injection, parent CWE-94) delivered via an untrusted model file (CWE-502).
- Validation: code-level verification at this repository's HEAD (source and sink lines re-read live); the identical defect was executed end to end on a sibling vendored copy of the same lineage (iMoonLab/yolov13) in an air-gapped container with harmless sentinel metadata strings and a negative control.

Impact
- Confidentiality: High (the evaluated expression runs with unrestricted builtins in the loading process, which typically holds dataset mounts, checkpoints and credentials)
- Integrity: High (the same reach applies to writing model files, checkpoints and working-tree source)
- Availability: High (the expression can terminate or hang the process, or delete what it can write)

CVSS v3.1
Score: 7.8 (High)
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Timeline
- Discovered: 2026-09-18
- Vendor notified: 2026-09-24 (issue <NUM> opened; mechanism and fix guidance only, harmless sentinel used in validation, no exploit attached)
- Patch released: [pending]
- Public disclosure: 2026-09-24 (issue <NUM> published; exploit not released)

Countermeasure
Sync the vendored ultralytics copy to >= 8.3.234 (preferred), or cherry-pick the upstream one-liner commit 265b92fa: replace eval(v) with ast.literal_eval(v) at ultralytics/nn/autobackend.py:278 (ast is already imported in that file). Optional hardening: fail soft with try/except and default fallback; validate the parsed structure; apply the same handling to the external metadata.yaml branch.

• ソース: ⚠️ https://github.com/CASIA-LMC-Lab/FastSAM/issues/288
• ユーザー: Dem00000 (UID 98563)
• 送信: 2026年09月29日 10:01 (17 日 ago)
• モデレーション: 2026年10月15日 20:25 (16 days later)
• ステータス: 承諾済み
• VulDBエントリ: 420764 [Ultralytics FastSAM 迄 b4ed20c2fed75eadc5aa7d8b09fedd137b873b52 AutoBackend Model Loading autobackend.py session.get_modelmeta.custom_metadata_map imgsz/names/kpt_shape Local Privilege Escalation]
• ポイント: 20