Submeter #1004881: ImprintLab Medical-SAM-Adapter up to main commit 5888e722876511f177e8e762498a7986753b7f7d (vendors ultralytics 8.0.120) Code Injection

A vulnerability was found in Medical-SAM-Adapter up to main commit 5888e722876511f177e8e762498a7986753b7f7d and classified as high 7.8. Affected is the vendored ultralytics AutoBackend model-loading component (models/MobileSAMv2/ultralytics/nn/autobackend.py). The manipulation of the ONNX metadata_props imgsz/names/kpt_shape strings leads to code injection. The attack is launched locally: the victim has to load an attacker-supplied .onnx model file.

Technical Details
- Affected file/function (verified at the current default branch 5888e722876511f177e8e762498a7986753b7f7d on 2026-09-24):
models/MobileSAMv2/ultralytics/nn/autobackend.py:132 reads the model file's own custom_metadata_map via session.get_modelmeta(); models/MobileSAMv2/ultralytics/nn/autobackend.py:278 passes the imgsz/names/kpt_shape values through eval(). There is no validation, allowlist or sandbox between the two; the evaluation runs before any inference call, and no opt-in exists. check_class_names() inspects only the result after the sink and cannot prevent execution. The same file already uses ast.literal_eval for its TFLite metadata branch; an external metadata.yaml sidecar next to the weights reaches the same loop as a second channel.
- Vulnerable parameter: metadata_props entries imgsz/names/kpt_shape (an arbitrary string-to-string map) inside an .onnx file, and optionally a metadata.yaml sidecar next to the weights
- Attack vector: Local
- Privileges required: None
- Trigger condition: loading the model file is sufficient - the sink is inside AutoBackend.__init__, before any inference. Rewriting metadata_props requires no signing key and leaves the file loading and inferring normally.
- Origin of the weakness: this repository vendors ultralytics 8.0.120. The vendored tree is a customised 8.0.120: a git blob-SHA comparison against upstream tag v8.0.120 (2026-09-24) shows 141 of 160 package files byte-identical, 4 files modified (`nn/modules/head.py`, `yolo/utils/ops.py` and two more) and 15 upstream files pruned. `nn/autobackend.py` — the file containing the sink — is byte-identical to upstream v8.0.120, so the upstream one-line fix applies verbatim. The upstream ultralytics project replaced the eval() with ast.literal_eval() in release v8.3.234 (commit 265b92fa084e05f54eb5d2dc18eafcd056e23457, PR #22847, 2025-12-01). The copy vendored here predates that release: the exposure arises from the dependency on the vulnerable ultralytics version (CWE-1395), with the underlying defect being CWE-95 (eval injection, parent CWE-94) delivered via an untrusted model file (CWE-502).
- Validation: code-level verification at this repository's HEAD (source and sink lines re-read live); the identical defect was executed end to end on a sibling vendored copy of the same lineage (iMoonLab/yolov13) in an air-gapped container with harmless sentinel metadata strings and a negative control.

Impact
- Confidentiality: High (the evaluated expression runs with unrestricted builtins in the loading process, which typically holds dataset mounts, checkpoints and credentials)
- Integrity: High (the same reach applies to writing model files, checkpoints and working-tree source)
- Availability: High (the expression can terminate or hang the process, or delete what it can write)

CVSS v3.1
Score: 7.8 (High)
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

• Fonte: ⚠️ https://github.com/ImprintLab/Medical-SAM-Adapter/issues/145
• Utilizador: Dem00000 (UID 98563)
• Submissão: 29/09/2026 10h00 (há 17 dias)
• Moderação: 15/10/2026 20h13 (16 days later)
• Estado: Aceite
• Entrada VulDB: 420763 [ImprintLab Medical-SAM-Adapter 0.1.0/0.1.0-alpha AutoBackend Model Loading autobackend.py session.get_modelmeta.custom_metadata_map imgsz/names/kpt_shape Local Privilege Escalation]
• Pontos: 20