CVE-2026-111865

Received Received - Intake

Stored Code Injection in THU-MIG yoloe

Publication date: 2026-10-17

Last updated on: 2026-10-17

Assigner: VulDB

Description

A security flaw has been discovered in THU-MIG yoloe up to 40cd606cabdbe2b566d6f14a6b162c89206e9a1b. This affects the function eval of the file ultralytics/nn/autobackend.py of the component AutoBackend Model Loading. The manipulation of the argument imgsz/names/kpt_shape results in improper neutralization of directives in dynamically evaluated code. The attack requires a local approach. The exploit has been released to the public and may be used for attacks. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-17

Last Modified

2026-10-17

Generated

2026-10-18

AI Q&A

2026-10-18

EPSS Evaluated

N/A

NVD

CVE-2026-111865

Affected Vendors & Products

Vendor	Product	Version / Range
THU-MIG	yoloe	40cd606cabdbe2b566d6f14a6b162c89206e9a1b

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CWE-95	The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").

Attack-Flow Graph

Executive Summary

This vulnerability is in THU-MIG yoloe, specifically in the AutoBackend Model Loading component. It involves improper neutralization of directives in dynamically evaluated code in the eval function of ultralytics/nn/autobackend.py. The flaw allows manipulation of arguments like imgsz, names, or kpt_shape, enabling code injection. The attack requires local access and has a public exploit available.

Impact Analysis

If exploited, this vulnerability could allow an attacker with local access to execute arbitrary code on your system. This may lead to unauthorized data access, system compromise, or further network infiltration. The impact depends on the privileges of the affected application.

Compliance Impact

This vulnerability does not directly impact compliance with GDPR or HIPAA as it involves local code execution requiring user access. However, improper neutralization of directives in dynamically evaluated code could lead to unauthorized data access or manipulation, potentially violating confidentiality requirements in GDPR or HIPAA if exploited.

Mitigation Strategies

Immediately stop using THU-MIG yoloe up to commit 40cd606cabdbe2b566d6f14a6b162c89206e9a1b. Review and remove any usage of the AutoBackend Model Loading component in ultralytics/nn/autobackend.py. Apply input validation for arguments imgsz, names, and kpt_shape to prevent code injection.

Hi! I’m here to help you understand CVE-2026-111865. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70