Submit #1007973: WongKinYiu yolov9 up to commit 5b1ea9a8b3f0ffe4fe0e203ec6232d788bb3fcff (master HEAD, 2024-06-10) Code Injection

A vulnerability was found in WongKinYiu yolov9 up to commit 5b1ea9a8b3f0ffe4fe0e203ec6232d788bb3fcff (master HEAD, 2024-06-10) and classified as high 8.8. Affected is the DetectMultiBackend component in models/common.py (ONNX Runtime branch, lines 729-733). The manipulation of the ONNX metadata_props names entry of a model file leads to code injection (CWE-95 Eval Injection / CWE-94 Code Injection). User interaction is required: a victim must run the documented CLI (python detect.py --weights <file>.onnx --source <image>) on a crafted weights file shared by the attacker.

Technical Details
- Affected file/function: models/common.py / DetectMultiBackend.__init__, ONNX Runtime branch
- Vulnerable parameter: the "names" (and "stride") entries of the ONNX metadata_props map, read via session.get_modelmeta().custom_metadata_map
- Attack vector: Network (the malicious .onnx is delivered as a shared/downloaded weights file)
- Privileges required: None
- Trigger condition: eval(meta['names']) at models/common.py:733 executes the attacker string at model-load time; the payload can return a valid class-name dict so the detection run completes normally with no visible signal. The sibling TFLite branch at :832 already uses ast.literal_eval for the same kind of metadata. The same line is inherited from the yolov5 lineage and also ships in yolov5-lineage fork copies (e.g. spmallick/learnopencv, FedML-AI/FedML, VoltaML/voltaML).

Impact
- Confidentiality: High (arbitrary Python execution with the victim's privileges)
- Integrity: High (arbitrary file write/modify; demonstrated by an inert marker-file payload)
- Availability: High (process termination/destabilization possible)

CVSS v3.1
Score: 8.8 (High)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
(under a strict AV:L reading: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H = 7.8 High)

Timeline
- Discovered: 2026-09
- Vendor notified: [pending]
- Patch released: [pending]
- Public disclosure: [pending]

Countermeasure
Replace eval(meta['names']) with ast.literal_eval, validate the parsed value as list[str] or dict[int, str] (fall back to the dataset config otherwise), apply the same treatment to int(meta['stride']), and audit the other backend branches that consume file metadata.

• Source: ⚠️ https://github.com/WongKinYiu/yolov9/issues/670
• User: r1ck99 (UID 100733)
• Submission: 09/30/2026 17:08 (29 days ago)
• Moderation: 10/18/2026 00:17 (17 days later)
• Status: Accepted
• VulDB entry: 421656 [WongKinYiu yolov9 0.1 ONNX Metadata models/common.py DetectMultiBackend.__init__ names/stride code injection]
• Points: 20