CVE-2026-111237: Ultralytics FastSAM AutoBackend Model Loading autobackend.py session.get_modelmeta.custom_metadata_map eval injection
A weakness has been identified in Ultralytics FastSAM up to b4ed20c2fed75eadc5aa7d8b09fedd137b873b52. This affects the function session.getmodelmeta.custommetadatamap of the file ultralytics/nn/autobackend.py of the component AutoBackend Model Loading. This manipulation of the argument imgsz/names/kptshape causes improper neutralization of directives in dynamically evaluated code. The attack requires local access. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Exposure is limited to users who have local access and can influence the imgsz, names, or kpt_shape arguments used during AutoBackend model loading. The provided information does not indicate remote exploitation.
What must an attacker be able to control to exploit it?
The attacker needs local access and the ability to manipulate imgsz, names, or kpt_shape values processed through session.get_modelmeta.custom_metadata_map in ultralytics/nn/autobackend.py. Those values can reach dynamically evaluated code without proper neutralization.
How can I determine whether my deployment may be affected?
Review whether your FastSAM installation includes the affected AutoBackend model-loading code in ultralytics/nn/autobackend.py and whether locally supplied model metadata can control imgsz, names, or kpt_shape. Affected releases are identified only as up to commit b4ed20c2fed75eadc5aa7d8b09fedd137b873b52; no fixed-version information is available.
What can be done if an update is not available?
Restrict local access to systems that load FastSAM models, and do not load models or metadata from untrusted sources. Prevent untrusted users or processes from supplying or modifying imgsz, names, and kpt_shape metadata values.