Code Injection Vulnerability in Ultralytics Product from Ultralytics

CVE-2026-118616

What is CVE-2026-118616?

A code injection vulnerability exists within the parse_model function in Ultralytics. This flaw arises due to inadequate validation of user-supplied strings, which can be manipulated by an attacker to execute arbitrary Python code on affected installations. Successful exploitation necessitates user interaction, as the target must visit a compromised web page or open a malicious file. When executed, the arbitrary code runs with the privileges of the current user, potentially leading to further exploitation or data compromise.

References