CVE-2026-108945 | iMoonLab yolov13 up to 73289949533efac82bb5f72ec19b746618656bd2 AutoBackend Model Loading autobackend.py eval imgsz/names/kpt_shape code injection (Issue 81)

October 11, 2026 Yanac

A vulnerability has been found in iMoonLab yolov13 up to 73289949533efac82bb5f72ec19b746618656bd2 and classified as problematic. Affected by this issue is the function eval of the file ultralytics/nn/autobackend.py of the component AutoBackend Model Loading. Performing a manipulation of the argument imgsz/names/kpt_shape results in code injection.

This vulnerability is cataloged as CVE-2026-108945. The attack must be initiated from a local position. There is no exploit available.

The project was informed of the problem early through an issue report but has not responded yet.VulDB Recent EntriesRead More