CVE-2026-111237
A weakness has been identified in Ultralytics FastSAM up to b4ed20c2fed75eadc5aa7d8b09fedd137b873b52. This affects the function session.get_modelmeta.custom_metadata_map of the file ultralytics/nn/autobackend.py of the component AutoBackend Model Loading. This manipulation of the argument imgsz/names/kpt_shape causes improper neutralization of directives in dynamically evaluated code. The attack requires local access. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.
- Score
- CVSS 3.1 5.3 Medium
- Status
- Deferred - cna@vuldb.com
- Published
- 2026-10-16
- Last modified
- 2026-10-21
- Weaknesses
- CWE-94, CWE-95
Affected products
References
- https://vuldb.com/vuln/420764
- https://vuldb.com/vuln/420764/cti
- https://vuldb.com/cve/CVE-2026-111237
- https://vuldb.com/submit/1004882
- https://github.com/CASIA-LMC-Lab/FastSAM/issues/288
