CVE-2026-111212: ImprintLab Medical-SAM-Adapter AutoBackend Model Loading autobackend.py session.get_modelmeta.custom_metadata_map eval injection
A security flaw has been discovered in ImprintLab Medical-SAM-Adapter 0.1.0-alpha/0.1.0. Affected by this issue is the function session.getmodelmeta.custommetadatamap of the file models/MobileSAMv2/ultralytics/nn/autobackend.py of the component AutoBackend Model Loading. The manipulation of the argument imgsz/names/kptshape results in improper neutralization of directives in dynamically evaluated code. The attack requires a local approach. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Which releases should be considered affected?
The reported affected releases are ImprintLab Medical-SAM-Adapter 0.1.0-alpha and 0.1.0.
What level of access and interaction does exploitation require?
The reported attack vector is local. The CVSS vector indicates low privileges are required and that user interaction is required.
Is exploitation likely to be practical?
A public exploit has been released and may be used in attacks. The report rates exploit maturity as proof-of-concept.
Is a vendor response or fix available?
The project was reportedly notified through an issue report but had not responded at the time of publication. No fix or workaround is provided in the available information.