Ultralytics: Code injection in check_det_dataset allows code execution
Summary
The Ultralytics YOLO framework contains a code injection flaw in the check_det_dataset function. The function executes a user-supplied string as Python code without proper validation. An attacker can run code with the privileges of the current user if the target visits a malicious page or opens a malicious file. ZDI rates the CVSS vector as local with user interaction, while the description says remote attackers; both describe the same practical scenario.
Affected
- Ultralytics (product name as listed by ZDI and the CNA)
- The CNA record lists 8.4.65 as affected; other sources conflict and the NVD analysis is pending.
- Exact affected version range: Unknown.
Fixed in
Unknown.
Workaround
- No vendor fix or workaround is documented.
- ZDI's only stated mitigation is to restrict interaction with the product.
- Only use dataset YAML files and other input files from trusted sources.
- Run training in isolated environments or containers without sensitive credentials.
Exploitation
- Not known to be exploited in the wild; not listed in CISA KEV as of 26-28 Oct 2026.
- No public proof-of-concept or exploit code found.
- EPSS: 0.2 % (percentile 10).
Our recommendation
- Check whether Ultralytics is used in your organisation, for example via pip in Python environments.
- Restrict use of untrusted datasets and files in these environments until a fix is available.
- Keep the Ultralytics package pinned and monitor the vendor's GitHub security advisories and releases for a fix.
- Recheck CISA KEV and the NVD record for changes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- ZDI advisory ZDI-26-813 www.zerodayinitiative.com
- OffSeq: ZDI-26-813 exploitation and mitigation radar.offseq.com
- OffSeq: CVE-2026-118614 affected versions radar.offseq.com
- Strix: CVE-2026-118614 www.strix.ai
- NixOS nixpkgs tracker issue github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 21:46.
Original description (NVD)
Ultralytics check_det_dataset Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the check_det_dataset function. The issue results from the lack of proper validation of a user-supplied string before using it to execute Python code. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-30119.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.