Read the docs
TI-2026-76077 Aliases CVE-2026-111865GHSA-j8p7-jccj-5wpx

Eval injection in THU-MIG yoloe AutoBackend model loading

Priority MEDIUM 55CWE-94Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
Low · Low · Low
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-94.

Summary

THU-MIG yoloe up to 40cd606cabdbe2b566d6f14a6b162c89206e9a1b contains an eval injection flaw in the eval function of ultralytics/nn/autobackend.py (CWE-95). Manipulating the imgsz, names or kpt_shape argument lets input reach dynamically evaluated code without proper neutralization. A local attacker with low privileges can exploit this, and a public exploit has been released.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

A security flaw has been discovered in THU-MIG yoloe up to 40cd606cabdbe2b566d6f14a6b162c89206e9a1b. This affects the function eval of the file ultralytics/nn/autobackend.py of the component AutoBackend Model Loading. The manipulation of the argument imgsz/names/kpt_shape results in improper neutralization of directives in dynamically evaluated code. The attack requires a local approach. The exploit has been released to the public and may be used for attacks. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00123 2nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
THU-MIGyoloe40cd606cabdbe2b566d6f14a6b162c89206e9a1b—No fix listedCNA
  • yoloe VendorTHU-MIG Affected 40cd606cabdbe2b566d6f14a6b162c89206e9a1b Fixed in — No fix listed CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:thu-mig:yoloe:*:*:*:*:*:*:*:*———
  • cpe:2.3:a:thu-mig:yoloe:*:*:*:*:*:*:*:* Versions — — ·—

Remediation

The sources list no fixed version for yoloe.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Timeline

  1. 2026-10-18 Threatist record created from CVE-2026-111865
  2. 2026-10-18 Alias added: GHSA-j8p7-jccj-5wpx
  3. 2026-10-19 CISA SSVC decision points changed
  4. 2026-10-19 Priority changed: LOW → MEDIUM

References

Exploit 1

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences