Description
A security flaw has been discovered in THU-MIG yoloe up to 40cd606cabdbe2b566d6f14a6b162c89206e9a1b. This affects the function eval of the file ultralytics/nn/autobackend.py of the component AutoBackend Model Loading. The manipulation of the argument imgsz/names/kpt_shape results in improper neutralization of directives in dynamically evaluated code. The attack requires a local approach. The exploit has been released to the public and may be used for attacks. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.
Published: 2026-10-17
Score: 4.8 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Local arbitrary code execution
Action: Assess Impact
AI Analysis

Impact

The vulnerability resides in the autobackend.py component of THU-MIG yoloe, where manipulating the imgsz, names, or kpt_shape arguments leads to insecure use of eval. According to the description, the filter that neutralizes directives in the dynamically evaluated code is ineffective, allowing an attacker to execute arbitrary code on the host. This flaw is classified as CWE‑94 and CWE‑95. The impact is local arbitrary code execution limited to the context in which the backend runs.

Affected Systems

Any installation of THU-MIG yoloe that includes the AutoBackend component and is built from source prior to the commit 40cd606cabdbe2b566d6f14a6b162c89206e9a1b is vulnerable. Because the project does not use versioning, all releases containing that commit are affected. Users relying on the Autobackend functionality should verify the commit hash or upgrade once a patch is released.

Risk and Exploitability

The CVSS score of 4.8 indicates moderate severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack requires local access to the system where the backend runs, as the exploit takes advantage of user‑provided arguments. The public release of the exploit means that anyone who can run or influence the backend can potentially inject code. Because no patch has been released, the risk remains until an updated version or mitigation is applied.

Generated by OpenCVE AI on October 17, 2026 at 22:20 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Check the project repository for a commit that fixes the eval injection in ultralytics/nn/autobackend.py and upgrade the installation to that version.
  • If no fix has been released, modify the source to remove the eval call or restrict it to trusted input, ensuring that imgsz, names, and kpt_shape are strictly validated to prevent arbitrary code execution.
  • Run the yoloe backend with the least privilege necessary and monitor execution logs for unexpected code paths that might indicate exploitation.

Generated by OpenCVE AI on October 17, 2026 at 22:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 19 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sat, 17 Oct 2026 21:00:00 +0000

Type Values Removed Values Added
Description A security flaw has been discovered in THU-MIG yoloe up to 40cd606cabdbe2b566d6f14a6b162c89206e9a1b. This affects the function eval of the file ultralytics/nn/autobackend.py of the component AutoBackend Model Loading. The manipulation of the argument imgsz/names/kpt_shape results in improper neutralization of directives in dynamically evaluated code. The attack requires a local approach. The exploit has been released to the public and may be used for attacks. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.
Title THU-MIG yoloe AutoBackend Model Loading autobackend.py eval eval injection
First Time appeared Thu-mig
Thu-mig yoloe
Weaknesses CWE-94
CWE-95
CPEs cpe:2.3:a:thu-mig:yoloe:*:*:*:*:*:*:*:*
Vendors & Products Thu-mig
Thu-mig yoloe
References
Metrics cvssV2_0

{'score': 4.3, 'vector': 'AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 5.3, 'vector': 'CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV4_0

{'score': 4.8, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Thu-mig Yoloe
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-19T15:04:22.292Z

Reserved: 2026-10-17T07:09:34.194Z

Link: CVE-2026-111865

cve-icon Vulnrichment

Updated: 2026-10-19T15:04:12.899Z

cve-icon NVD

Status : Deferred

Published: 2026-10-17T21:16:25.793

Modified: 2026-10-19T22:10:00.130

Link: CVE-2026-111865

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-20T14:00:15Z

Weaknesses
  • CWE-94

    Improper Control of Generation of Code ('Code Injection')

  • CWE-95

    Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')