iMoonLab yolov13 CVE-2026-108945

Exploitation requires the attacker to supply or tamper with a model file that is subsequently loaded by the AutoBackend model-loading path, such that eval() is invoked on the attacker-controlled imgsz, names, or kpt_shape metadata fields. Limiting factors: the attack is local only (AV:L) and requires low privileges (PR:L) - the attacker must already be able to introduce a malicious model artifact into the victim's pipeline (e.g., an untrusted downloaded model, a shared model registry, or a writable model directory). It cannot be triggered remotely or against a process that only loads trusted, first-party model files.

This is a genuinely medium/low real-world priority despite the alarming 'RCE'/'Code Injection' tags. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N) and the description agree on the key constraint: the attack 'must be initiated from a local position' and requires low privileges (PR:L), so it is not a remotely exploitable, unauthenticated flaw. No EPSS score, no CISA KEV listing, and no public proof-of-concept were provided, which is consistent with a very recently disclosed VulDB-sourced issue against a niche research project. The upstream project has not responded to the issue report, so no vendor confirmation or patch exists. The signals are internally consistent (local vector + low privilege + no exploitation telemetry = low urgency); the only mild tension is between the 'RCE' tag and the AV:L vector - this is local code execution via a crafted model artifact, not network RCE, so the tag overstates remote reach. Verify the exact affected feature path with the maintainers, as no advisory confirms it.

An attacker who can place or substitute a model file in a victim's YOLOv13/Ultralytics inference pipeline embeds a malicious payload in the model metadata fields (imgsz, names, or kpt_shape). When AutoBackend loads the model and calls eval() on this attacker-controlled metadata, the payload executes as arbitrary Python code in the loading process. No public exploit was identified at time of analysis, but the eval()-on-untrusted-metadata pattern is trivially weaponizable by anyone able to supply a model file.