CVE-2026-111865 | THU-MIG yoloe up to 40cd606cabdbe2b566d6f14a6b162c89206e9a1b AutoBackend Model Loading autobackend.py eval imgsz/names/kpt_shape eval injection (Issue 148)

October 17, 2026 Yanac

A vulnerability was found in THU-MIG yoloe up to 40cd606cabdbe2b566d6f14a6b162c89206e9a1b and classified as problematic. This affects the function eval of the file ultralytics/nn/autobackend.py of the component AutoBackend Model Loading. The manipulation of the argument imgsz/names/kpt_shape results in improper neutralization of directives in dynamically evaluated code.

This vulnerability is reported as CVE-2026-111865. The attack requires a local approach. Moreover, an exploit is present.

This product does not use versioning. This is why information about affected and unaffected releases are unavailable.

The project was informed of the problem early through an issue report but has not responded yet.VulDB Recent EntriesRead More