CVE-2026-111212
Received Received - Intake

Improper Neutralization of Code Injection in ImprintLab Medical-SAM-Adapter

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: VulDB

Description
A security flaw has been discovered in ImprintLab Medical-SAM-Adapter 0.1.0-alpha/0.1.0. Affected by this issue is the function session.get_modelmeta.custom_metadata_map of the file models/MobileSAMv2/ultralytics/nn/autobackend.py of the component AutoBackend Model Loading. The manipulation of the argument imgsz/names/kpt_shape results in improper neutralization of directives in dynamically evaluated code. The attack requires a local approach. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-111212
EUVD
EUVD-2026-102550

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
ImprintLab Medical-SAM-Adapter 0.1.0
ImprintLab Medical-SAM-Adapter 0.1.0-alpha

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-95 The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in ImprintLab Medical-SAM-Adapter 0.1.0-alpha/0.1.0. It involves improper neutralization of directives in dynamically evaluated code in the function session.get_modelmeta.custom_metadata_map of the file models/MobileSAMv2/ultralytics/nn/autobackend.py. The issue arises when arguments like imgsz, names, or kpt_shape are manipulated, allowing code injection. The attack requires local access and an exploit has been publicly released.

Detection Guidance

Check for the presence of the vulnerable file models/MobileSAMv2/ultralytics/nn/autobackend.py in ImprintLab Medical-SAM-Adapter installations. Inspect the file for eval() usage at lines 132 and 278 where metadata_props are processed. Verify if the vendored ultralytics version is 8.0.120 or older.

Impact Analysis

If exploited, this vulnerability could allow an attacker to execute arbitrary code on your system. Since it requires local access, it may enable unauthorized data access, modification, or system compromise. Users of ImprintLab Medical-SAM-Adapter should update to a patched version immediately to mitigate risks.

Compliance Impact

This vulnerability allows arbitrary code execution during model loading, which could lead to unauthorized access to sensitive data, manipulation of files, or process termination. For GDPR, this could result in unauthorized processing of personal data, violating principles of lawfulness and integrity. For HIPAA, it may enable unauthorized access to protected health information, compromising confidentiality and integrity requirements.

Mitigation Strategies

Immediately stop using ImprintLab Medical-SAM-Adapter 0.1.0-alpha/0.1.0. Remove or disable the component to prevent exploitation. Monitor for any suspicious activity related to model loading or code execution. Apply patches or updates if provided by the vendor in the future.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111212. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart