CVE-2026-111865

Name of the Vulnerable Software and Affected Versions THU-MIG yoloe versions up to 40cd606cabdbe2b566d6f14a6b162c89206e9a1b

Description An issue exists in the AutoBackend Model Loading component within the eval() function of the ultralytics/nn/autobackend.py file. Improper neutralization of directives in dynamically evaluated code occurs when the imgsz, names, or kpt shape arguments are manipulated. This flaw requires a local approach to exploit.

Recommendations As a temporary workaround, restrict the use of the imgsz, names, and kpt shape arguments within the eval() function until a fix is provided. At the moment, there is no information about a newer version that contains a fix for this vulnerability.