Ultralytics CVE-2026-118614

Exploitation requires the victim to process an attacker-controlled input that reaches the check_det_dataset function - per the description, the target must open a malicious file or visit a malicious page - where an unvalidated user-supplied string is used to execute Python code (CWE-94). Limiting factors: the attack vector is local (AV:L) and mandatory user interaction is required (UI:R), so it cannot be triggered against an unattended or network-exposed service without a victim action; scope is unchanged (S:U) and code runs only with the current user's privileges, giving no built-in privilege escalation. The exact string/field and the configuration path that reaches the vulnerable call are not detailed in the available sources.

This is a credible but interaction-gated code-execution issue rather than a drop-everything emergency. The input CVSS 3.0 vector (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8 HIGH) describes a local attack vector with low complexity and no required privileges, but conditioned on user interaction - the victim must open a malicious file or visit a malicious page. The vuln.today decision label is 'this_week', consistent with a serious flaw that is not under active exploitation. No EPSS score, no CISA KEV listing, and no verified public exploit were supplied, so there is no evidence of in-the-wild abuse; exploitation status is 'no public exploit identified at time of analysis' (the single reference is the ZDI advisory ZDI-26-813, an advisory rather than exploit code). The main tension to flag: the description's phrase 'remote attackers' reads as network-facing, yet the CVSS vector is AV:L and gated on UI:R - this is a local/interaction-driven vector (the attacker delivers a malicious dataset/file the victim processes), not an unauthenticated remote network service exploit; defenders should not treat it as internet-reachable RCE. PR:N indicates no authentication is needed, but the UI:R requirement and local vector materially reduce real-world mass-exploitation risk, pointing toward targeted social-engineering use. SSVC-style signals beyond the decision label (automatable, exploitation state) were not provided.

An attacker crafts a malicious dataset configuration (or file/page delivering one) whose string value is consumed by Ultralytics' check_det_dataset function and is executed as Python code without validation. A data scientist or ML engineer loads the attacker-supplied dataset - e.g. from a shared repo, download, or page - triggering arbitrary code execution in the context of their user account. Exploitation requires that user interaction (AV:L/UI:R); no public exploit code was identified at time of analysis.