Code Injection Vulnerability in Ultralytics FastSAM AutoBackend Model Loading Component

CVE-2026-111237

What is CVE-2026-111237?

A vulnerability in Ultralytics FastSAM's AutoBackend model loading process has been detected, which could lead to code injection. Specifically, the issue resides in the session.get_modelmeta.custom_metadata_map function within the ultralytics/nn/autobackend.py file. Improper handling of the arguments imgsz/names/kpt_shape could allow an attacker with local access to manipulate executed code, leading to potential security breaches. While the project has been notified of this issue, a response has yet to be documented. Continuous updates are provided through a rolling release model, which complicates the identification of affected versions.

References