CVE-2026-111865 Details
Description
A security flaw has been discovered in THU-MIG yoloe up to 40cd606cabdbe2b566d6f14a6b162c89206e9a1b. This affects the function eval of the file ultralytics/nn/autobackend.py of the component AutoBackend Model Loading. The manipulation of the argument imgsz/names/kpt_shape results in improper neutralization of directives in dynamically evaluated code. The attack requires a local approach. The exploit has been released to the public and may be used for attacks. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.
A vulnerability allowing arbitrary code execution has been identified in THU-MIG YOLOE, specifically in the AutoBackend model loading feature. This issue arises from the improper handling of metadata properties in ONNX models, which are evaluated as Python expressions during the model loading process. The vulnerability is present in the ultralytics/nn/autobackend.py file, within the bundled ultralytics version 8.3.39. The flaw allows execution of attacker-chosen Python code, with the evaluated expressions running before any model inference, creating a potential risk for unauthorized actions or data access.
Users are advised to update the bundled ultralytics library to version 8.3.234 or later, or to apply a manual patch that replaces the eval() function with ast.literal_eval() for safer metadata handling.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 17, 2026CISA-ADP
Assessed Oct 19, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/THU-MIG/yoloe/ | [email protected] | ProductSource CodeVendor |
| https://github.com/THU-MIG/yoloe/issues/148 | [email protected] | ExploitIssue TrackingRemedyTechnical DescriptionVendor |
| https://vuldb.com/cve/CVE-2026-111865 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/1004883 | [email protected] | Permission Required |
| https://vuldb.com/vuln/421573 | [email protected] | Permission Required |
| https://vuldb.com/vuln/421573/cti | [email protected] | AdvisoryContent Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
| CWE-95 | Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| THU-MIG yoloe | <= 40cd606cabdbe2b566d6f14a6b162c89206e9a1b |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 19, 2026 | CVE Translated | [email protected] |
| Oct 19, 2026 | CVE Modified | CISA-ADP |
| Oct 17, 2026 | New CVE Received | [email protected] |