Code Injection Vulnerability in Ultralytics Product
CVE-2026-118618

7.8HIGH

Key Information:

Vendor

Ultralytics

Status
Ultralytics
Vendor
CVE Published:
28 October 2026

What is CVE-2026-118618?

The code injection vulnerability in the parse_model function of Ultralytics allows remote attackers to execute arbitrary code on affected installations. Exploitation requires user interaction, such as visiting a malicious webpage or opening a harmful file. The flaw arises due to inadequate validation of user-supplied strings prior to their use in executing Python code. Successful exploitation enables an attacker to execute code in the context of the current user, significantly compromising system integrity.

Affected Version(s)

Ultralytics 8.4.65

References

https://www.zerodayinitiative.com/advisories/ZDI-26-817/
x_research-advisory

CVSS V3.0

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.