CVE-2026-108945: iMoonLab yolov13 AutoBackend Model Loading autobackend.py eval code injection
A vulnerability was detected in iMoonLab yolov13 up to 73289949533efac82bb5f72ec19b746618656bd2. Affected by this issue is the function eval of the file ultralytics/nn/autobackend.py of the component AutoBackend Model Loading. Performing a manipulation of the argument imgsz/names/kptshape results in code injection. The attack must be initiated from a local position. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to exploitation?
Exploitation must be initiated from a local position. The affected component is AutoBackend model loading in iMoonLab yolov13, where values supplied through imgsz, names, or kpt_shape can reach eval.
What level of access does an attacker need?
The published severity vector indicates low privileges are required and no user interaction is needed. The attacker must be able to locally manipulate the imgsz, names, or kpt_shape argument during model loading.
Which versions are affected?
iMoonLab yolov13 versions up to commit 73289949533efac82bb5f72ec19b746618656bd2 are reported as affected. No fixed version is identified in the provided information.
What can be done if a patch is not available?
Avoid loading models or configuration data whose imgsz, names, or kpt_shape values can be modified by untrusted local users. Restrict local access and limit write permissions to model files and related configuration inputs used by AutoBackend.
Is a vendor fix available?
No response from the project is reported after it was notified through an issue report. The provided information does not identify a patch or remediation release.