Ultralytics
Monthly
Path traversal in Ultralytics's Google Drive download handling lets remote, unauthenticated attackers place files outside the intended download destination and ultimately execute arbitrary code in the context of the current process - provided the victim first visits a malicious page or opens a malicious file. The flaw (CWE-22, ZDI-CAN-32376) is rated 8.8 with a UI:R vector, so it is interaction-gated rather than a self-propagating or wormable issue, and it only applies where the application actually exercises the Google Drive download code path. No public exploit code is confirmed, the CVE is not listed in CISA KEV, and no EPSS score was supplied; the vuln.today decision label places it at this_week priority - genuine and worth scheduling, not a drop-everything emergency.
Code injection in Ultralytics' parse_model function lets an attacker execute arbitrary Python code with the privileges of the current user when the victim opens a malicious model file or otherwise loads attacker-controlled input. The root cause is CWE-94: a user-supplied string is not validated before being used to execute Python code; the assessed vector is CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, so no privileges are required but user interaction is mandatory. There is no network-facing, zero-click path in the described flaw, and no public exploit has been identified at time of analysis; the vuln.today decision label is 'this_week'.
Deserialization of untrusted data in Ultralytics' load_dataset_cache_file function allows arbitrary code execution in the context of the current user when a victim loads an attacker-supplied dataset whose cache data is processed by that routine. The flaw is rated 7.8 (CVSS:3.0/3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) because exploitation is local rather than network-reachable and depends entirely on convincing the user to open or load the malicious file - a social-engineering prerequisite that meaningfully narrows realistic exposure despite the high confidentiality, integrity and availability impact. Reported to the vendor by Trend Micro Zero Day Initiative (ZDI-CAN-30124 / ZDI-26-816); no public exploit code has been identified at time of analysis and no CISA KEV entry exists, and the source data provides no EPSS score.
Code injection in Ultralytics' parse_model function lets an attacker execute arbitrary Python in the context of the current user when a victim loads a crafted model definition or configuration, such as by visiting a malicious page or opening a malicious file (ZDI-CAN-30123). The CVSS vector is local (AV:L) and requires user interaction (UI:R) with no privileges required (PR:N), giving a 7.8 High severity score with high confidentiality, integrity and availability impact, though code execution is bounded by the victim's own privileges (S:U). No public exploit code has been identified at time of analysis and the flaw has not been reported as actively exploited; the vendor advisory ZDI-26-815 is the primary reference.
OS command injection in Ultralytics' torch_safe_load function allows an attacker who supplies a crafted model file to execute arbitrary code with the privileges of the user who loads it. Reachability is limited: the assessed vector is local (AV:L) with mandatory user interaction (UI:R), so an attacker cannot trigger the flaw across the network and must instead convince the victim to open a malicious model/weights file or visit a page that causes such a load - CVSS 3.0 base score 7.8 (High) is scored PR:N but the practical gate is the victim's action. No public exploit code identified at time of analysis, and realistic exposure is confined to environments that ingest third-party or community weights rather than only trusted, internally produced models.
Code injection in the Ultralytics Python package's check_det_dataset function lets an attacker execute arbitrary Python in the context of the user running the library. Per the supplied CVSS vector the weakness is locally reachable and unauthenticated (AV:L/PR:N), but it is gated by user interaction (UI:R) - the victim must open a crafted file or visit a malicious page that feeds an unvalidated string into the vulnerable call - and the resulting code runs only with the current user's privileges (S:U). No CISA KEV entry or confirmed public exploit code was identified at time of analysis; the only public reference is the ZDI advisory ZDI-26-813, and the CPE string wildcards all Ultralytics versions as potentially affected.
Deserialization of untrusted data in Ultralytics' torch_load function allows code to run in the context of the current user when a victim loads a malicious PyTorch model or weights file, or visits a page that causes such a file to be deserialized. The assessed vector is CVSS 3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (7.8): no authentication is required (PR:N), but the Local vector and mandatory user interaction mean there is no unauthenticated network-reachable trigger, and code execution does not cross a privilege boundary. No CISA KEV entry and no public exploit were identified at time of analysis; priority is scheduled remediation this week rather than emergency response.
Path traversal in Ultralytics's Google Drive download handling lets remote, unauthenticated attackers place files outside the intended download destination and ultimately execute arbitrary code in the context of the current process - provided the victim first visits a malicious page or opens a malicious file. The flaw (CWE-22, ZDI-CAN-32376) is rated 8.8 with a UI:R vector, so it is interaction-gated rather than a self-propagating or wormable issue, and it only applies where the application actually exercises the Google Drive download code path. No public exploit code is confirmed, the CVE is not listed in CISA KEV, and no EPSS score was supplied; the vuln.today decision label places it at this_week priority - genuine and worth scheduling, not a drop-everything emergency.
Code injection in Ultralytics' parse_model function lets an attacker execute arbitrary Python code with the privileges of the current user when the victim opens a malicious model file or otherwise loads attacker-controlled input. The root cause is CWE-94: a user-supplied string is not validated before being used to execute Python code; the assessed vector is CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, so no privileges are required but user interaction is mandatory. There is no network-facing, zero-click path in the described flaw, and no public exploit has been identified at time of analysis; the vuln.today decision label is 'this_week'.
Deserialization of untrusted data in Ultralytics' load_dataset_cache_file function allows arbitrary code execution in the context of the current user when a victim loads an attacker-supplied dataset whose cache data is processed by that routine. The flaw is rated 7.8 (CVSS:3.0/3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) because exploitation is local rather than network-reachable and depends entirely on convincing the user to open or load the malicious file - a social-engineering prerequisite that meaningfully narrows realistic exposure despite the high confidentiality, integrity and availability impact. Reported to the vendor by Trend Micro Zero Day Initiative (ZDI-CAN-30124 / ZDI-26-816); no public exploit code has been identified at time of analysis and no CISA KEV entry exists, and the source data provides no EPSS score.
Code injection in Ultralytics' parse_model function lets an attacker execute arbitrary Python in the context of the current user when a victim loads a crafted model definition or configuration, such as by visiting a malicious page or opening a malicious file (ZDI-CAN-30123). The CVSS vector is local (AV:L) and requires user interaction (UI:R) with no privileges required (PR:N), giving a 7.8 High severity score with high confidentiality, integrity and availability impact, though code execution is bounded by the victim's own privileges (S:U). No public exploit code has been identified at time of analysis and the flaw has not been reported as actively exploited; the vendor advisory ZDI-26-815 is the primary reference.
OS command injection in Ultralytics' torch_safe_load function allows an attacker who supplies a crafted model file to execute arbitrary code with the privileges of the user who loads it. Reachability is limited: the assessed vector is local (AV:L) with mandatory user interaction (UI:R), so an attacker cannot trigger the flaw across the network and must instead convince the victim to open a malicious model/weights file or visit a page that causes such a load - CVSS 3.0 base score 7.8 (High) is scored PR:N but the practical gate is the victim's action. No public exploit code identified at time of analysis, and realistic exposure is confined to environments that ingest third-party or community weights rather than only trusted, internally produced models.
Code injection in the Ultralytics Python package's check_det_dataset function lets an attacker execute arbitrary Python in the context of the user running the library. Per the supplied CVSS vector the weakness is locally reachable and unauthenticated (AV:L/PR:N), but it is gated by user interaction (UI:R) - the victim must open a crafted file or visit a malicious page that feeds an unvalidated string into the vulnerable call - and the resulting code runs only with the current user's privileges (S:U). No CISA KEV entry or confirmed public exploit code was identified at time of analysis; the only public reference is the ZDI advisory ZDI-26-813, and the CPE string wildcards all Ultralytics versions as potentially affected.
Deserialization of untrusted data in Ultralytics' torch_load function allows code to run in the context of the current user when a victim loads a malicious PyTorch model or weights file, or visits a page that causes such a file to be deserialized. The assessed vector is CVSS 3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (7.8): no authentication is required (PR:N), but the Local vector and mandatory user interaction mean there is no unauthenticated network-reachable trigger, and code execution does not cross a privilege boundary. No CISA KEV entry and no public exploit were identified at time of analysis; priority is scheduled remediation this week rather than emergency response.