Vulnerability-Lookup

Search criteria

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-118619 (GCVE-0-2026-118619)

Vulnerability from nvd – Published: 2026-10-28 16:54 – Updated: 2026-10-28 16:54

Title

Ultralytics Google Drive Download Path Traversal Remote Code Execution Vulnerability

Summary

Ultralytics Google Drive Download Path Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of downloads from Google Drive. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute arbitrary code in the context of the current process. Was ZDI-CAN-32376.

Severity

8.8 (High)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

zdi CNA under the mitre root

CNA scorecard C 73/100 over 139 records in the last 180 days details

References

1 reference

URL	Tags
https://www.zerodayinitiative.com/advisories/ZDI-…	x_research-advisory

Impacted products

1 product

Vendor	Product	Version
Ultralytics	Ultralytics	Affected: 8.4.103

Date Public

2026-10-28 16:31

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Ultralytics",
          "vendor": "Ultralytics",
          "versions": [
            {
              "status": "affected",
              "version": "8.4.103"
            }
          ]
        }
      ],
      "dateAssigned": "2026-10-28T16:53:46.820Z",
      "datePublic": "2026-10-28T16:31:36.742Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Ultralytics Google Drive Download Path Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the handling of downloads from Google Drive. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute arbitrary code in the context of the current process. Was ZDI-CAN-32376."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-28T16:54:34.850Z",
        "orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
        "shortName": "zdi"
      },
      "references": [
        {
          "name": "ZDI-26-818",
          "tags": [
            "x_research-advisory"
          ],
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-26-818/"
        }
      ],
      "source": {
        "lang": "en",
        "value": "Anonymous"
      },
      "title": "Ultralytics Google Drive Download Path Traversal Remote Code Execution Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
    "assignerShortName": "zdi",
    "cveId": "CVE-2026-118619",
    "datePublished": "2026-10-28T16:54:34.850Z",
    "dateReserved": "2026-10-28T16:53:46.779Z",
    "dateUpdated": "2026-10-28T16:54:34.850Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-118618 (GCVE-0-2026-118618)

Vulnerability from nvd – Published: 2026-10-28 16:54 – Updated: 2026-10-28 16:54

Title

Ultralytics parse_model Code Injection Remote Code Execution Vulnerability

Summary

Ultralytics parse_model Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parse_model function. The issue results from the lack of proper validation of a user-supplied string before using it to execute Python code. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-30121.

Severity

7.8 (High)


                        
                          CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE

CWE-94 - Improper Control of Generation of Code ('Code Injection')

Assigner

zdi CNA under the mitre root

CNA scorecard C 73/100 over 139 records in the last 180 days details

References

1 reference

URL	Tags
https://www.zerodayinitiative.com/advisories/ZDI-…	x_research-advisory

Impacted products

1 product

Vendor	Product	Version
Ultralytics	Ultralytics	Affected: 8.4.65

Date Public

2026-10-28 16:31

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Ultralytics",
          "vendor": "Ultralytics",
          "versions": [
            {
              "status": "affected",
              "version": "8.4.65"
            }
          ]
        }
      ],
      "dateAssigned": "2026-10-28T16:53:42.340Z",
      "datePublic": "2026-10-28T16:31:30.095Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Ultralytics parse_model Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parse_model function. The issue results from the lack of proper validation of a user-supplied string before using it to execute Python code. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-30121."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-28T16:54:29.943Z",
        "orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
        "shortName": "zdi"
      },
      "references": [
        {
          "name": "ZDI-26-817",
          "tags": [
            "x_research-advisory"
          ],
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-26-817/"
        }
      ],
      "source": {
        "lang": "en",
        "value": "Bongeun Koo (@kiddo_pwn)"
      },
      "title": "Ultralytics parse_model Code Injection Remote Code Execution Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
    "assignerShortName": "zdi",
    "cveId": "CVE-2026-118618",
    "datePublished": "2026-10-28T16:54:29.943Z",
    "dateReserved": "2026-10-28T16:53:42.313Z",
    "dateUpdated": "2026-10-28T16:54:29.943Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-118617 (GCVE-0-2026-118617)

Vulnerability from nvd – Published: 2026-10-28 16:54 – Updated: 2026-10-28 16:54

Title

Ultralytics load_dataset_cache_file Deserialization of Untrusted Data Remote Code Execution Vulnerability

Summary

Ultralytics load_dataset_cache_file Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the load_dataset_cache_file function. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-30124.

Severity

7.8 (High)


                        
                          CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE

CWE-502 - Deserialization of Untrusted Data

Assigner

zdi CNA under the mitre root

CNA scorecard C 73/100 over 139 records in the last 180 days details

References

1 reference

URL	Tags
https://www.zerodayinitiative.com/advisories/ZDI-…	x_research-advisory

Impacted products

1 product

Vendor	Product	Version
Ultralytics	Ultralytics	Affected: 8.4.65

Date Public

2026-10-28 16:31

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Ultralytics",
          "vendor": "Ultralytics",
          "versions": [
            {
              "status": "affected",
              "version": "8.4.65"
            }
          ]
        }
      ],
      "dateAssigned": "2026-10-28T16:53:38.959Z",
      "datePublic": "2026-10-28T16:31:25.393Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Ultralytics load_dataset_cache_file Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the load_dataset_cache_file function. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-30124."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-502",
              "description": "CWE-502: Deserialization of Untrusted Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-28T16:54:24.766Z",
        "orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
        "shortName": "zdi"
      },
      "references": [
        {
          "name": "ZDI-26-816",
          "tags": [
            "x_research-advisory"
          ],
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-26-816/"
        }
      ],
      "source": {
        "lang": "en",
        "value": "Bongeun Koo (@kiddo_pwn)"
      },
      "title": "Ultralytics load_dataset_cache_file Deserialization of Untrusted Data Remote Code Execution Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
    "assignerShortName": "zdi",
    "cveId": "CVE-2026-118617",
    "datePublished": "2026-10-28T16:54:24.766Z",
    "dateReserved": "2026-10-28T16:53:38.934Z",
    "dateUpdated": "2026-10-28T16:54:24.766Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-118616 (GCVE-0-2026-118616)

Vulnerability from nvd – Published: 2026-10-28 16:54 – Updated: 2026-10-28 16:54

Title

Ultralytics parse_model Code Injection Remote Code Execution Vulnerability

Summary

Ultralytics parse_model Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parse_model function. The issue results from the lack of proper validation of a user-supplied string before using it to execute Python code. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-30123.

Severity

7.8 (High)


                        
                          CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE

CWE-94 - Improper Control of Generation of Code ('Code Injection')

Assigner

zdi CNA under the mitre root

CNA scorecard C 73/100 over 139 records in the last 180 days details

References

1 reference

URL	Tags
https://www.zerodayinitiative.com/advisories/ZDI-…	x_research-advisory

Impacted products

1 product

Vendor	Product	Version
Ultralytics	Ultralytics	Affected: 8.4.65

Date Public

2026-10-28 16:31

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Ultralytics",
          "vendor": "Ultralytics",
          "versions": [
            {
              "status": "affected",
              "version": "8.4.65"
            }
          ]
        }
      ],
      "dateAssigned": "2026-10-28T16:53:35.763Z",
      "datePublic": "2026-10-28T16:31:19.406Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Ultralytics parse_model Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parse_model function. The issue results from the lack of proper validation of a user-supplied string before using it to execute Python code. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-30123."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-28T16:54:20.598Z",
        "orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
        "shortName": "zdi"
      },
      "references": [
        {
          "name": "ZDI-26-815",
          "tags": [
            "x_research-advisory"
          ],
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-26-815/"
        }
      ],
      "source": {
        "lang": "en",
        "value": "Bongeun Koo (@kiddo_pwn)"
      },
      "title": "Ultralytics parse_model Code Injection Remote Code Execution Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
    "assignerShortName": "zdi",
    "cveId": "CVE-2026-118616",
    "datePublished": "2026-10-28T16:54:20.598Z",
    "dateReserved": "2026-10-28T16:53:35.736Z",
    "dateUpdated": "2026-10-28T16:54:20.598Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-118615 (GCVE-0-2026-118615)

Vulnerability from nvd – Published: 2026-10-28 16:54 – Updated: 2026-10-28 16:54

Title

Ultralytics torch_safe_load Command Injection Remote Code Execution Vulnerability

Summary

Ultralytics torch_safe_load Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the torch_safe_load function. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-30122.

Severity

7.8 (High)


                        
                          CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Assigner

zdi CNA under the mitre root

CNA scorecard C 73/100 over 139 records in the last 180 days details

References

1 reference

URL	Tags
https://www.zerodayinitiative.com/advisories/ZDI-…	x_research-advisory

Impacted products

1 product

Vendor	Product	Version
Ultralytics	Ultralytics	Affected: 8.4.65

Date Public

2026-10-28 16:31

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Ultralytics",
          "vendor": "Ultralytics",
          "versions": [
            {
              "status": "affected",
              "version": "8.4.65"
            }
          ]
        }
      ],
      "dateAssigned": "2026-10-28T16:53:32.337Z",
      "datePublic": "2026-10-28T16:31:12.091Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Ultralytics torch_safe_load Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the torch_safe_load function. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-30122."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-28T16:54:16.852Z",
        "orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
        "shortName": "zdi"
      },
      "references": [
        {
          "name": "ZDI-26-814",
          "tags": [
            "x_research-advisory"
          ],
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-26-814/"
        }
      ],
      "source": {
        "lang": "en",
        "value": "Bongeun Koo (@kiddo_pwn)"
      },
      "title": "Ultralytics torch_safe_load Command Injection Remote Code Execution Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
    "assignerShortName": "zdi",
    "cveId": "CVE-2026-118615",
    "datePublished": "2026-10-28T16:54:16.852Z",
    "dateReserved": "2026-10-28T16:53:32.311Z",
    "dateUpdated": "2026-10-28T16:54:16.852Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-118614 (GCVE-0-2026-118614)

Vulnerability from nvd – Published: 2026-10-28 16:54 – Updated: 2026-10-28 16:54

Title

Ultralytics check_det_dataset Code Injection Remote Code Execution Vulnerability

Summary

Ultralytics check_det_dataset Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the check_det_dataset function. The issue results from the lack of proper validation of a user-supplied string before using it to execute Python code. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-30119.

Severity

7.8 (High)


                        
                          CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE

CWE-94 - Improper Control of Generation of Code ('Code Injection')

Assigner

zdi CNA under the mitre root

CNA scorecard C 73/100 over 139 records in the last 180 days details

References

1 reference

URL	Tags
https://www.zerodayinitiative.com/advisories/ZDI-…	x_research-advisory

Impacted products

1 product

Vendor	Product	Version
Ultralytics	Ultralytics	Affected: 8.4.65

Date Public

2026-10-28 16:31

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Ultralytics",
          "vendor": "Ultralytics",
          "versions": [
            {
              "status": "affected",
              "version": "8.4.65"
            }
          ]
        }
      ],
      "dateAssigned": "2026-10-28T16:53:28.761Z",
      "datePublic": "2026-10-28T16:31:06.872Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Ultralytics check_det_dataset Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the check_det_dataset function. The issue results from the lack of proper validation of a user-supplied string before using it to execute Python code. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-30119."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-28T16:54:13.021Z",
        "orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
        "shortName": "zdi"
      },
      "references": [
        {
          "name": "ZDI-26-813",
          "tags": [
            "x_research-advisory"
          ],
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-26-813/"
        }
      ],
      "source": {
        "lang": "en",
        "value": "Bongeun Koo (@kiddo_pwn)"
      },
      "title": "Ultralytics check_det_dataset Code Injection Remote Code Execution Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
    "assignerShortName": "zdi",
    "cveId": "CVE-2026-118614",
    "datePublished": "2026-10-28T16:54:13.021Z",
    "dateReserved": "2026-10-28T16:53:28.735Z",
    "dateUpdated": "2026-10-28T16:54:13.021Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-118613 (GCVE-0-2026-118613)

Vulnerability from nvd – Published: 2026-10-28 16:54 – Updated: 2026-10-28 16:54

Title

Ultralytics torch_load Deserialization of Untrusted Data Remote Code Execution Vulnerability

Summary

Ultralytics torch_load Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the torch_load function. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-29652.

Severity

7.8 (High)


                        
                          CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE

CWE-502 - Deserialization of Untrusted Data

Assigner

zdi CNA under the mitre root

CNA scorecard C 73/100 over 139 records in the last 180 days details

References

1 reference

URL	Tags
https://www.zerodayinitiative.com/advisories/ZDI-…	x_research-advisory

Impacted products

1 product

Vendor	Product	Version
Ultralytics	Ultralytics	Affected: 8.4.65

Date Public

2026-10-28 16:30

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Ultralytics",
          "vendor": "Ultralytics",
          "versions": [
            {
              "status": "affected",
              "version": "8.4.65"
            }
          ]
        }
      ],
      "dateAssigned": "2026-10-28T16:53:25.589Z",
      "datePublic": "2026-10-28T16:30:59.857Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Ultralytics torch_load Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the torch_load function. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-29652."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-502",
              "description": "CWE-502: Deserialization of Untrusted Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-28T16:54:09.055Z",
        "orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
        "shortName": "zdi"
      },
      "references": [
        {
          "name": "ZDI-26-812",
          "tags": [
            "x_research-advisory"
          ],
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-26-812/"
        }
      ],
      "source": {
        "lang": "en",
        "value": "Anonymous"
      },
      "title": "Ultralytics torch_load Deserialization of Untrusted Data Remote Code Execution Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
    "assignerShortName": "zdi",
    "cveId": "CVE-2026-118613",
    "datePublished": "2026-10-28T16:54:09.055Z",
    "dateReserved": "2026-10-28T16:53:25.562Z",
    "dateUpdated": "2026-10-28T16:54:09.055Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-118619 (GCVE-0-2026-118619)

Vulnerability from cvelistv5 – Published: 2026-10-28 16:54 – Updated: 2026-10-28 16:54

Title

Ultralytics Google Drive Download Path Traversal Remote Code Execution Vulnerability

Summary

Ultralytics Google Drive Download Path Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of downloads from Google Drive. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute arbitrary code in the context of the current process. Was ZDI-CAN-32376.

Severity

8.8 (High)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

zdi CNA under the mitre root

CNA scorecard C 73/100 over 139 records in the last 180 days details

References

1 reference

URL	Tags
https://www.zerodayinitiative.com/advisories/ZDI-…	x_research-advisory

Impacted products

1 product

Vendor	Product	Version
Ultralytics	Ultralytics	Affected: 8.4.103

Date Public

2026-10-28 16:31

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Ultralytics",
          "vendor": "Ultralytics",
          "versions": [
            {
              "status": "affected",
              "version": "8.4.103"
            }
          ]
        }
      ],
      "dateAssigned": "2026-10-28T16:53:46.820Z",
      "datePublic": "2026-10-28T16:31:36.742Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Ultralytics Google Drive Download Path Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the handling of downloads from Google Drive. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute arbitrary code in the context of the current process. Was ZDI-CAN-32376."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-28T16:54:34.850Z",
        "orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
        "shortName": "zdi"
      },
      "references": [
        {
          "name": "ZDI-26-818",
          "tags": [
            "x_research-advisory"
          ],
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-26-818/"
        }
      ],
      "source": {
        "lang": "en",
        "value": "Anonymous"
      },
      "title": "Ultralytics Google Drive Download Path Traversal Remote Code Execution Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
    "assignerShortName": "zdi",
    "cveId": "CVE-2026-118619",
    "datePublished": "2026-10-28T16:54:34.850Z",
    "dateReserved": "2026-10-28T16:53:46.779Z",
    "dateUpdated": "2026-10-28T16:54:34.850Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-118618 (GCVE-0-2026-118618)

Vulnerability from cvelistv5 – Published: 2026-10-28 16:54 – Updated: 2026-10-28 16:54

Title

Ultralytics parse_model Code Injection Remote Code Execution Vulnerability

Summary

Ultralytics parse_model Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parse_model function. The issue results from the lack of proper validation of a user-supplied string before using it to execute Python code. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-30121.

Severity

7.8 (High)


                        
                          CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE

CWE-94 - Improper Control of Generation of Code ('Code Injection')

Assigner

zdi CNA under the mitre root

CNA scorecard C 73/100 over 139 records in the last 180 days details

References

1 reference

URL	Tags
https://www.zerodayinitiative.com/advisories/ZDI-…	x_research-advisory

Impacted products

1 product

Vendor	Product	Version
Ultralytics	Ultralytics	Affected: 8.4.65

Date Public

2026-10-28 16:31

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Ultralytics",
          "vendor": "Ultralytics",
          "versions": [
            {
              "status": "affected",
              "version": "8.4.65"
            }
          ]
        }
      ],
      "dateAssigned": "2026-10-28T16:53:42.340Z",
      "datePublic": "2026-10-28T16:31:30.095Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Ultralytics parse_model Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parse_model function. The issue results from the lack of proper validation of a user-supplied string before using it to execute Python code. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-30121."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-28T16:54:29.943Z",
        "orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
        "shortName": "zdi"
      },
      "references": [
        {
          "name": "ZDI-26-817",
          "tags": [
            "x_research-advisory"
          ],
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-26-817/"
        }
      ],
      "source": {
        "lang": "en",
        "value": "Bongeun Koo (@kiddo_pwn)"
      },
      "title": "Ultralytics parse_model Code Injection Remote Code Execution Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
    "assignerShortName": "zdi",
    "cveId": "CVE-2026-118618",
    "datePublished": "2026-10-28T16:54:29.943Z",
    "dateReserved": "2026-10-28T16:53:42.313Z",
    "dateUpdated": "2026-10-28T16:54:29.943Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-118617 (GCVE-0-2026-118617)

Vulnerability from cvelistv5 – Published: 2026-10-28 16:54 – Updated: 2026-10-28 16:54

Title

Ultralytics load_dataset_cache_file Deserialization of Untrusted Data Remote Code Execution Vulnerability

Summary

Ultralytics load_dataset_cache_file Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the load_dataset_cache_file function. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-30124.

Severity

7.8 (High)


                        
                          CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE

CWE-502 - Deserialization of Untrusted Data

Assigner

zdi CNA under the mitre root

CNA scorecard C 73/100 over 139 records in the last 180 days details

References

1 reference

URL	Tags
https://www.zerodayinitiative.com/advisories/ZDI-…	x_research-advisory

Impacted products

1 product

Vendor	Product	Version
Ultralytics	Ultralytics	Affected: 8.4.65

Date Public

2026-10-28 16:31

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Ultralytics",
          "vendor": "Ultralytics",
          "versions": [
            {
              "status": "affected",
              "version": "8.4.65"
            }
          ]
        }
      ],
      "dateAssigned": "2026-10-28T16:53:38.959Z",
      "datePublic": "2026-10-28T16:31:25.393Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Ultralytics load_dataset_cache_file Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the load_dataset_cache_file function. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-30124."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-502",
              "description": "CWE-502: Deserialization of Untrusted Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-28T16:54:24.766Z",
        "orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
        "shortName": "zdi"
      },
      "references": [
        {
          "name": "ZDI-26-816",
          "tags": [
            "x_research-advisory"
          ],
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-26-816/"
        }
      ],
      "source": {
        "lang": "en",
        "value": "Bongeun Koo (@kiddo_pwn)"
      },
      "title": "Ultralytics load_dataset_cache_file Deserialization of Untrusted Data Remote Code Execution Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
    "assignerShortName": "zdi",
    "cveId": "CVE-2026-118617",
    "datePublished": "2026-10-28T16:54:24.766Z",
    "dateReserved": "2026-10-28T16:53:38.934Z",
    "dateUpdated": "2026-10-28T16:54:24.766Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-118616 (GCVE-0-2026-118616)

Vulnerability from cvelistv5 – Published: 2026-10-28 16:54 – Updated: 2026-10-28 16:54

Title

Ultralytics parse_model Code Injection Remote Code Execution Vulnerability

Summary

Ultralytics parse_model Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parse_model function. The issue results from the lack of proper validation of a user-supplied string before using it to execute Python code. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-30123.

Severity

7.8 (High)


                        
                          CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE

CWE-94 - Improper Control of Generation of Code ('Code Injection')

Assigner

zdi CNA under the mitre root

CNA scorecard C 73/100 over 139 records in the last 180 days details

References

1 reference

URL	Tags
https://www.zerodayinitiative.com/advisories/ZDI-…	x_research-advisory

Impacted products

1 product

Vendor	Product	Version
Ultralytics	Ultralytics	Affected: 8.4.65

Date Public

2026-10-28 16:31

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Ultralytics",
          "vendor": "Ultralytics",
          "versions": [
            {
              "status": "affected",
              "version": "8.4.65"
            }
          ]
        }
      ],
      "dateAssigned": "2026-10-28T16:53:35.763Z",
      "datePublic": "2026-10-28T16:31:19.406Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Ultralytics parse_model Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parse_model function. The issue results from the lack of proper validation of a user-supplied string before using it to execute Python code. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-30123."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-28T16:54:20.598Z",
        "orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
        "shortName": "zdi"
      },
      "references": [
        {
          "name": "ZDI-26-815",
          "tags": [
            "x_research-advisory"
          ],
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-26-815/"
        }
      ],
      "source": {
        "lang": "en",
        "value": "Bongeun Koo (@kiddo_pwn)"
      },
      "title": "Ultralytics parse_model Code Injection Remote Code Execution Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
    "assignerShortName": "zdi",
    "cveId": "CVE-2026-118616",
    "datePublished": "2026-10-28T16:54:20.598Z",
    "dateReserved": "2026-10-28T16:53:35.736Z",
    "dateUpdated": "2026-10-28T16:54:20.598Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-118615 (GCVE-0-2026-118615)

Vulnerability from cvelistv5 – Published: 2026-10-28 16:54 – Updated: 2026-10-28 16:54

Title

Ultralytics torch_safe_load Command Injection Remote Code Execution Vulnerability

Summary

Ultralytics torch_safe_load Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the torch_safe_load function. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-30122.

Severity

7.8 (High)


                        
                          CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Assigner

zdi CNA under the mitre root

CNA scorecard C 73/100 over 139 records in the last 180 days details

References

1 reference

URL	Tags
https://www.zerodayinitiative.com/advisories/ZDI-…	x_research-advisory

Impacted products

1 product

Vendor	Product	Version
Ultralytics	Ultralytics	Affected: 8.4.65

Date Public

2026-10-28 16:31

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Ultralytics",
          "vendor": "Ultralytics",
          "versions": [
            {
              "status": "affected",
              "version": "8.4.65"
            }
          ]
        }
      ],
      "dateAssigned": "2026-10-28T16:53:32.337Z",
      "datePublic": "2026-10-28T16:31:12.091Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Ultralytics torch_safe_load Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the torch_safe_load function. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-30122."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-28T16:54:16.852Z",
        "orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
        "shortName": "zdi"
      },
      "references": [
        {
          "name": "ZDI-26-814",
          "tags": [
            "x_research-advisory"
          ],
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-26-814/"
        }
      ],
      "source": {
        "lang": "en",
        "value": "Bongeun Koo (@kiddo_pwn)"
      },
      "title": "Ultralytics torch_safe_load Command Injection Remote Code Execution Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
    "assignerShortName": "zdi",
    "cveId": "CVE-2026-118615",
    "datePublished": "2026-10-28T16:54:16.852Z",
    "dateReserved": "2026-10-28T16:53:32.311Z",
    "dateUpdated": "2026-10-28T16:54:16.852Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-118614 (GCVE-0-2026-118614)

Vulnerability from cvelistv5 – Published: 2026-10-28 16:54 – Updated: 2026-10-28 16:54

Title

Ultralytics check_det_dataset Code Injection Remote Code Execution Vulnerability

Summary

Ultralytics check_det_dataset Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the check_det_dataset function. The issue results from the lack of proper validation of a user-supplied string before using it to execute Python code. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-30119.

Severity

7.8 (High)


                        
                          CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE

CWE-94 - Improper Control of Generation of Code ('Code Injection')

Assigner

zdi CNA under the mitre root

CNA scorecard C 73/100 over 139 records in the last 180 days details

References

1 reference

URL	Tags
https://www.zerodayinitiative.com/advisories/ZDI-…	x_research-advisory

Impacted products

1 product

Vendor	Product	Version
Ultralytics	Ultralytics	Affected: 8.4.65

Date Public

2026-10-28 16:31

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Ultralytics",
          "vendor": "Ultralytics",
          "versions": [
            {
              "status": "affected",
              "version": "8.4.65"
            }
          ]
        }
      ],
      "dateAssigned": "2026-10-28T16:53:28.761Z",
      "datePublic": "2026-10-28T16:31:06.872Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Ultralytics check_det_dataset Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the check_det_dataset function. The issue results from the lack of proper validation of a user-supplied string before using it to execute Python code. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-30119."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-28T16:54:13.021Z",
        "orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
        "shortName": "zdi"
      },
      "references": [
        {
          "name": "ZDI-26-813",
          "tags": [
            "x_research-advisory"
          ],
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-26-813/"
        }
      ],
      "source": {
        "lang": "en",
        "value": "Bongeun Koo (@kiddo_pwn)"
      },
      "title": "Ultralytics check_det_dataset Code Injection Remote Code Execution Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
    "assignerShortName": "zdi",
    "cveId": "CVE-2026-118614",
    "datePublished": "2026-10-28T16:54:13.021Z",
    "dateReserved": "2026-10-28T16:53:28.735Z",
    "dateUpdated": "2026-10-28T16:54:13.021Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-118613 (GCVE-0-2026-118613)

Vulnerability from cvelistv5 – Published: 2026-10-28 16:54 – Updated: 2026-10-28 16:54

Title

Ultralytics torch_load Deserialization of Untrusted Data Remote Code Execution Vulnerability

Summary

Ultralytics torch_load Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the torch_load function. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-29652.

Severity

7.8 (High)


                        
                          CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE

CWE-502 - Deserialization of Untrusted Data

Assigner

zdi CNA under the mitre root

CNA scorecard C 73/100 over 139 records in the last 180 days details

References

1 reference

URL	Tags
https://www.zerodayinitiative.com/advisories/ZDI-…	x_research-advisory

Impacted products

1 product

Vendor	Product	Version
Ultralytics	Ultralytics	Affected: 8.4.65

Date Public

2026-10-28 16:30

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Ultralytics",
          "vendor": "Ultralytics",
          "versions": [
            {
              "status": "affected",
              "version": "8.4.65"
            }
          ]
        }
      ],
      "dateAssigned": "2026-10-28T16:53:25.589Z",
      "datePublic": "2026-10-28T16:30:59.857Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Ultralytics torch_load Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the torch_load function. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-29652."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-502",
              "description": "CWE-502: Deserialization of Untrusted Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-28T16:54:09.055Z",
        "orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
        "shortName": "zdi"
      },
      "references": [
        {
          "name": "ZDI-26-812",
          "tags": [
            "x_research-advisory"
          ],
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-26-812/"
        }
      ],
      "source": {
        "lang": "en",
        "value": "Anonymous"
      },
      "title": "Ultralytics torch_load Deserialization of Untrusted Data Remote Code Execution Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
    "assignerShortName": "zdi",
    "cveId": "CVE-2026-118613",
    "datePublished": "2026-10-28T16:54:09.055Z",
    "dateReserved": "2026-10-28T16:53:25.562Z",
    "dateUpdated": "2026-10-28T16:54:09.055Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Find a vulnerability

Search criteria

14 vulnerabilities found for Ultralytics by Ultralytics

CVE-2026-118619 (GCVE-0-2026-118619)

CVE-2026-118618 (GCVE-0-2026-118618)

CVE-2026-118617 (GCVE-0-2026-118617)

CVE-2026-118616 (GCVE-0-2026-118616)

CVE-2026-118615 (GCVE-0-2026-118615)

CVE-2026-118614 (GCVE-0-2026-118614)

CVE-2026-118613 (GCVE-0-2026-118613)

CVE-2026-118619 (GCVE-0-2026-118619)

CVE-2026-118618 (GCVE-0-2026-118618)

CVE-2026-118617 (GCVE-0-2026-118617)

CVE-2026-118616 (GCVE-0-2026-118616)

CVE-2026-118615 (GCVE-0-2026-118615)

CVE-2026-118614 (GCVE-0-2026-118614)

CVE-2026-118613 (GCVE-0-2026-118613)