Fastsam
Monthly
Code injection in Ultralytics FastSAM's AutoBackend model-loading path lets a crafted model file execute arbitrary Python when its metadata entries (imgsz, names, kpt_shape) are passed into a dynamically evaluated expression from session.get_modelmeta().custom_metadata_map in ultralytics/nn/autobackend.py. The attack is bounded to the local model-loading surface - there is no network-facing exposure - and requires that a user or process loads an attacker-supplied model artifact, so the practical prerequisite is delivering a malicious model to a victim rather than obtaining privileges on the host. VulDB rates it 4.8 (medium) under CVSS 4.0 with low confidentiality/integrity/availability impact and PR:L/UI:N, while our independent assessment scores it CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, i.e. higher impact and requiring user interaction instead of prior authentication; no CISA KEV listing or public exploit code is present in the supplied data, and the maintainers were notified via a GitHub issue but have not responded, so no vendor-released patch is identified at time of analysis.
Code injection in Ultralytics FastSAM's AutoBackend model-loading path lets a crafted model file execute arbitrary Python when its metadata entries (imgsz, names, kpt_shape) are passed into a dynamically evaluated expression from session.get_modelmeta().custom_metadata_map in ultralytics/nn/autobackend.py. The attack is bounded to the local model-loading surface - there is no network-facing exposure - and requires that a user or process loads an attacker-supplied model artifact, so the practical prerequisite is delivering a malicious model to a victim rather than obtaining privileges on the host. VulDB rates it 4.8 (medium) under CVSS 4.0 with low confidentiality/integrity/availability impact and PR:L/UI:N, while our independent assessment scores it CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, i.e. higher impact and requiring user interaction instead of prior authentication; no CISA KEV listing or public exploit code is present in the supplied data, and the maintainers were notified via a GitHub issue but have not responded, so no vendor-released patch is identified at time of analysis.