Search
Find a vulnerability
Search criteria
2 vulnerabilities found for yoloe by THU-MIG
CVE-2026-111865 (GCVE-0-2026-111865)
Vulnerability from nvd – Published: 2026-10-17 20:45 – Updated: 2026-10-19 15:04
VLAI
EPSS
VEX
Title
THU-MIG yoloe AutoBackend Model Loading autobackend.py eval eval injection
Summary
A security flaw has been discovered in THU-MIG yoloe up to 40cd606cabdbe2b566d6f14a6b162c89206e9a1b. This affects the function eval of the file ultralytics/nn/autobackend.py of the component AutoBackend Model Loading. The manipulation of the argument imgsz/names/kpt_shape results in improper neutralization of directives in dynamically evaluated code. The attack requires a local approach. The exploit has been released to the public and may be used for attacks. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 15:03 UTC
CWE
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/421573 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/421573/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-111865 | third-party-advisory |
| https://vuldb.com/submit/1004883 | third-party-advisory |
| https://github.com/THU-MIG/yoloe/issues/148 | exploitissue-tracking |
| https://github.com/THU-MIG/yoloe/ | product |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111865",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T15:03:28.246820Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T15:04:22.292Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:thu-mig:yoloe:*:*:*:*:*:*:*:*"
],
"modules": [
"AutoBackend Model Loading"
],
"product": "yoloe",
"vendor": "THU-MIG",
"versions": [
{
"status": "affected",
"version": "40cd606cabdbe2b566d6f14a6b162c89206e9a1b"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Dem00000 (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security flaw has been discovered in THU-MIG yoloe up to 40cd606cabdbe2b566d6f14a6b162c89206e9a1b. This affects the function eval of the file ultralytics/nn/autobackend.py of the component AutoBackend Model Loading. The manipulation of the argument imgsz/names/kpt_shape results in improper neutralization of directives in dynamically evaluated code. The attack requires a local approach. The exploit has been released to the public and may be used for attacks. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4.3,
"vectorString": "AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-95",
"description": "Improper Neutralization of Directives in Dynamically Evaluated Code",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "Code Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-17T20:45:12.470Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-421573 | THU-MIG yoloe AutoBackend Model Loading autobackend.py eval eval injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/421573"
},
{
"name": "VDB-421573 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/421573/cti"
},
{
"name": "CVE-2026-111865 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-111865"
},
{
"name": "Submit #1004883 | THU-MIG yoloe up to main commit 40cd606cabdbe2b566d6f14a6b162c89206e9a1b (vendors ultralytics 8.3.39) Code Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1004883"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/THU-MIG/yoloe/issues/148"
},
{
"tags": [
"product"
],
"url": "https://github.com/THU-MIG/yoloe/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-17T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-17T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-17T09:14:39.000Z",
"value": "VulDB entry last update"
}
],
"title": "THU-MIG yoloe AutoBackend Model Loading autobackend.py eval eval injection",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-111865",
"datePublished": "2026-10-17T20:45:12.470Z",
"dateReserved": "2026-10-17T07:09:34.194Z",
"dateUpdated": "2026-10-19T15:04:22.292Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111865 (GCVE-0-2026-111865)
Vulnerability from cvelistv5 – Published: 2026-10-17 20:45 – Updated: 2026-10-19 15:04
VLAI
EPSS
VEX
Title
THU-MIG yoloe AutoBackend Model Loading autobackend.py eval eval injection
Summary
A security flaw has been discovered in THU-MIG yoloe up to 40cd606cabdbe2b566d6f14a6b162c89206e9a1b. This affects the function eval of the file ultralytics/nn/autobackend.py of the component AutoBackend Model Loading. The manipulation of the argument imgsz/names/kpt_shape results in improper neutralization of directives in dynamically evaluated code. The attack requires a local approach. The exploit has been released to the public and may be used for attacks. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 15:03 UTC
CWE
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/421573 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/421573/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-111865 | third-party-advisory |
| https://vuldb.com/submit/1004883 | third-party-advisory |
| https://github.com/THU-MIG/yoloe/issues/148 | exploitissue-tracking |
| https://github.com/THU-MIG/yoloe/ | product |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111865",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T15:03:28.246820Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T15:04:22.292Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:thu-mig:yoloe:*:*:*:*:*:*:*:*"
],
"modules": [
"AutoBackend Model Loading"
],
"product": "yoloe",
"vendor": "THU-MIG",
"versions": [
{
"status": "affected",
"version": "40cd606cabdbe2b566d6f14a6b162c89206e9a1b"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Dem00000 (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security flaw has been discovered in THU-MIG yoloe up to 40cd606cabdbe2b566d6f14a6b162c89206e9a1b. This affects the function eval of the file ultralytics/nn/autobackend.py of the component AutoBackend Model Loading. The manipulation of the argument imgsz/names/kpt_shape results in improper neutralization of directives in dynamically evaluated code. The attack requires a local approach. The exploit has been released to the public and may be used for attacks. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4.3,
"vectorString": "AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-95",
"description": "Improper Neutralization of Directives in Dynamically Evaluated Code",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "Code Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-17T20:45:12.470Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-421573 | THU-MIG yoloe AutoBackend Model Loading autobackend.py eval eval injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/421573"
},
{
"name": "VDB-421573 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/421573/cti"
},
{
"name": "CVE-2026-111865 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-111865"
},
{
"name": "Submit #1004883 | THU-MIG yoloe up to main commit 40cd606cabdbe2b566d6f14a6b162c89206e9a1b (vendors ultralytics 8.3.39) Code Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1004883"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/THU-MIG/yoloe/issues/148"
},
{
"tags": [
"product"
],
"url": "https://github.com/THU-MIG/yoloe/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-17T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-17T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-17T09:14:39.000Z",
"value": "VulDB entry last update"
}
],
"title": "THU-MIG yoloe AutoBackend Model Loading autobackend.py eval eval injection",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-111865",
"datePublished": "2026-10-17T20:45:12.470Z",
"dateReserved": "2026-10-17T07:09:34.194Z",
"dateUpdated": "2026-10-19T15:04:22.292Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}