CVE-2026-118614
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
A code injection vulnerability in the check_det_dataset function of Ultralytics allows remote code execution. The flaw stems from lack of validation of a user-supplied string before using it to execute Python code. User interaction is required — the target must visit a malicious page or open a malicious file.
Risk Assessment
An attacker can execute arbitrary code in the context of the current user, potentially leading to data compromise or further escalation. Risk applies to Ultralytics installations processing untrusted input.
Recommendation
Update Ultralytics to a patched version and avoid processing untrusted files or data through check_det_dataset. Consider restricting privileges of processes using the library.
Other vulnerabilities in Ultralytics
See all- CVE-2026-118619High
A path traversal vulnerability in Ultralytics during Google Drive downloads could lead to remote code execution. The flaw results from lack of proper validation of a user-supplied path before use in file operations. User interaction is required (visiting a malicious page or opening a malicious file).
- CVE-2026-118618High
A code injection vulnerability in the parse_model function of Ultralytics could lead to remote code execution. The flaw results from lack of proper validation of a user-supplied string before using it to execute Python code. User interaction is required (visiting a malicious page or opening a malicious file).
- CVE-2026-118617High
A deserialization of untrusted data vulnerability in the load_dataset_cache_file function of Ultralytics could lead to remote code execution. The flaw results from lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. User interaction is required (visiting a malicious page or opening a malicious file).
- CVE-2026-118616High
A code injection vulnerability in the parse_model function of Ultralytics could lead to remote code execution. The flaw results from lack of proper validation of a user-supplied string before using it to execute Python code. User interaction is required (visiting a malicious page or opening a malicious file).
- CVE-2026-118615High
A command injection vulnerability in the torch_safe_load function of Ultralytics could lead to remote code execution. The flaw results from lack of proper validation of a user-supplied string before using it to execute a system call. User interaction is required (visiting a malicious page or opening a malicious file).
- CVE-2026-118613High
A deserialization of untrusted data vulnerability in the torch_load function of Ultralytics allows remote code execution. The flaw results from lack of validation of user-supplied data. User interaction is required — the target must visit a malicious page or open a malicious file.
Original NVD description (English source)
Ultralytics check_det_dataset Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the check_det_dataset function. The issue results from the lack of proper validation of a user-supplied string before using it to execute Python code. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-30119.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS