PT-2026-115366

CVE-2026-111237

Published

2026-10-16

Updated

2026-10-21

Description by

CVSS 3.1

5.3

Medium

MetricsAV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Ultralytics FastSAM versions up to b4ed20c2fed75eadc5aa7d8b09fedd137b873b52

Description An issue exists in the AutoBackend Model Loading component within the session.get modelmeta.custom metadata map function of the ultralytics/nn/autobackend.py file. Manipulation of the imgsz, names, or kpt shape arguments leads to improper neutralization of directives in dynamically evaluated code. Exploitation of this flaw requires local access.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploitability

Exploit

Impacts

Researchers

Dem00000

Vendors

Affected products

Weakness enumeration

CWE-94: Improper Control of Generation of Code (\'Code Injection\')

CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code (\'Eval Injection\')

Related identifiers