The flaw lies in the custom_metadata_map function of ImprintLab Medical‑SAM‑Adapter. An attacker who can influence the imgsz, names, or kpt_shape parameters can craft input that is not properly neutralized before being passed to Python’s eval. This allows injection of arbitrary code during model loading, giving the attacker the ability to run any command on the host system with the privileges of the adapter process.

ImprintLab Medical‑SAM‑Adapter version 0.1.0‑alpha and 0.1.0 are affected. No patch version is listed, and the project has not issued a fix yet.

With a CVSS score of 2.4 the vulnerability is considered low severity by the metric, and the EPSS score of 0.00115 indicates a very low probability of exploitation. The exploit is local: an attacker must have enough access to supply the vulnerable inputs. A publicly disclosed exploit can be used by such an attacker, but gaining local access is a prerequisite. The risk therefore remains moderate for environments where the adapter runs with high privileges or is exposed to untrusted input.