Ultralytics: Code injection in parse_model allows remote code execution
Summary
Ultralytics, a Python library for computer vision (YOLO), contains a code injection flaw in its parse_model function. A user-supplied string is not validated before it is used to execute Python code. An attacker can run arbitrary code with the privileges of the current user if the user visits a malicious page or opens a malicious file. No vendor fix is available yet.
Affected
- Ultralytics 8.4.65 (CNA record and VulDB)
- Full affected range: Unknown.
Fixed in
Unknown. No fix or vendor advisory was published as of the ZDI advisory date.
Workaround
- Restrict interaction with the product: do not load model files, descriptors or configs from untrusted sources.
- Run Ultralytics in a restricted, non-privileged account or container.
Exploitation
- Not known to be exploited in the wild; not listed in CISA KEV.
- No public proof of concept recorded as of 26 October 2026.
- EPSS: 0.2 % (percentile 10).
Our recommendation
- Check whether Ultralytics is installed (for example with pip show ultralytics or a software inventory).
- If it is used, do not load untrusted models or configs and run it with limited rights.
- Monitor the Ultralytics GitHub repository and NVD for a fix, and patch promptly once one is available.
- Note: VulDB rates the CVE 6.3, while the CNA and ZDI rate it 7.8.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- ZDI-26-815 advisory www.zerodayinitiative.com
- VulDB VDB-428054 vuldb.com
- Strix CVE-2026-118616 www.strix.ai
- Offseq ZDI-26-815 exploitation record radar.offseq.com
- Aikido AIKIDO-2026-402371 (different issue, not confirmed as the same flaw) intel.aikido.dev
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 21:47.
Original description (NVD)
Ultralytics parse_model Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parse_model function. The issue results from the lack of proper validation of a user-supplied string before using it to execute Python code. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-30123.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.