CVE-2026-111865

MEDIUM 5.3

THU-MIG yoloe AutoBackend Model Loading autobackend.py eval eval injection

CVSS Score

5.3

EPSS Score

0.0%

EPSS Percentile

0th

A security flaw has been discovered in THU-MIG yoloe up to 40cd606cabdbe2b566d6f14a6b162c89206e9a1b. This affects the function eval of the file ultralytics/nn/autobackend.py of the component AutoBackend Model Loading. The manipulation of the argument imgsz/names/kpt_shape results in improper neutralization of directives in dynamically evaluated code. The attack requires a local approach. The exploit has been released to the public and may be used for attacks. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.

CWE	CWE-95 CWE-94
Vendor	thu-mig
Product	yoloe
Published	Oct 17, 2026

Stay Ahead of the Next One

Get instant alerts for thu-mig yoloe

Be the first to know when new medium vulnerabilities affecting thu-mig yoloe are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

THU-MIG / yoloe

40cd606cabdbe2b566d6f14a6b162c89206e9a1b

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/421573 vuldb.com: https://vuldb.com/vuln/421573/cti vuldb.com: https://vuldb.com/cve/CVE-2026-111865 vuldb.com: https://vuldb.com/submit/1004883 github.com: https://github.com/THU-MIG/yoloe/issues/148 github.com: https://github.com/THU-MIG/yoloe/

Credits

🔍 Dem00000 (VulDB User) VulDB CNA Team