The vulnerability arises from the use of an unsafe eval call in the AutoBackend component, specifically in a function within ultralytics/nn/autobackend.py. An attacker can manipulate the arguments passed to the function—imgsz, names, or kpt_shape—to inject code that will be executed during model loading. The injected code would run within the context of the application, potentially allowing the attacker to execute arbitrary commands or modify system state. This flaw is a classic code injection weakness (CWE-74) coupled with the misuse of eval (CWE-94). While the impact is confined to the local execution environment, it permits remote code execution if an attacker can trigger the vulnerable function through a compromise of the local machine or by crafting malicious inputs that the service processes.

The issue affects all releases of iMoonLab’s yolov13 model that include the vulnerable auto backend implementation. Specifically, any version of yolov13 built before the commit identified by 73289949533efac82bb5f72ec19b746618656bd2 is susceptible. Users should verify their deployment against this commit hash and consider updating to a later version if available.

The CVSS score for this flaw is 4.8, indicating moderate severity. EPSS is not available, so the probability of exploitation is undetermined, but the attack requires local access or control over the input parameters to the vulnerable function. The flaw is not listed in the CISA KEV catalog. An attacker with local privileges could trigger the eval injection and achieve arbitrary code execution, while an attacker without such access would need a foothold that allows manipulating the input to the auto backend. Consequently, the risk is primarily an elevation of local privilege or exploitation of a local code path rather than a remote denial of service or data breach.