IT SBIT Services
Schneeberger
DEEN
CVE tracker

Ultralytics: Command injection in torch_safe_load leads to code execution

CVE-2026-118615High 7.8

← All vulnerabilities

Summary

The torch_safe_load function in Ultralytics, a Python computer vision framework, does not properly validate a user-supplied string before using it in a system call. An attacker can exploit this by getting a user to visit a malicious page or open a malicious file, which executes arbitrary code with the privileges of the current user. No privileges are required, but user interaction is. No vendor fix has been published as of the latest information.

Affected

  • Ultralytics (Python package ultralytics), function torch_safe_load
  • Affected version according to the CVE record and VulDB: 8.4.65
  • ZDI lists no version range.
  • NixOS packaging lists 8.4.48 and 8.4.51 (unverified, packaging-level).

Fixed in

Unknown. No vendor advisory or fixed version has been identified. Ultralytics 8.4.189 (25 Oct 2026) is not linked to this CVE.

Workaround

  • ZDI's only mitigation: restrict interaction with the product.
  • Load model files and configuration only from trusted sources.
  • Run inference and training in isolated containers or VMs with low-privilege accounts and no access to secrets.
  • Keep the library off internet-facing services until a vendor fix is confirmed.

Exploitation

  • Publicly disclosed as a 0-day by ZDI on 28 Oct 2026.
  • No evidence of exploitation in the wild; not listed in CISA KEV.
  • No public proof-of-concept indexed as of 26 Oct 2026 (VulDB: no available exploit).
  • Private PoCs cannot be ruled out.

Our recommendation

  • Inventory installations, for example with 'pip show ultralytics'.
  • Restrict loading of model files and configurations to trusted sources.
  • Isolate ML workstations and CI runners that run Ultralytics, with low-privilege accounts and no stored credentials.
  • Monitor the Ultralytics GitHub repository and vendor channels for an advisory and patch, and update promptly once available.
  • Priority: medium; raise it where the library processes external files or runs on shared machines.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 21:47.

Original description (NVD)

Ultralytics torch_safe_load Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the torch_safe_load function. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-30122.

NVD references (1)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed