Remote Code Execution Vulnerability in Ultralytics Google Drive
CVE-2026-118619

8.8HIGH

Key Information:

Vendor

Ultralytics

Status
Ultralytics
Vendor
CVE Published:
28 October 2026

What is CVE-2026-118619?

The Ultralytics Google Drive integration is susceptible to a serious flaw that allows remote attackers to execute arbitrary code through improper path validation. This vulnerability arises when the application handles downloads and fails to adequately validate the user-supplied path. For exploitation, a user must interact with a malicious web page or file, enabling an attacker to run code in the context of the affected process. Awareness of this vulnerability is essential for users of Ultralytics to enhance their security posture.

Affected Version(s)

Ultralytics 8.4.103

References

https://www.zerodayinitiative.com/advisories/ZDI-26-818/
x_research-advisory

CVSS V3.0

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.