CVE-2026-111237

MediumCVSS 5.3/10Last modified Oct 21, 2026

Description

A weakness has been identified in Ultralytics FastSAM up to b4ed20c2fed75eadc5aa7d8b09fedd137b873b52. This affects the function session.get_modelmeta.custom_metadata_map of the file ultralytics/nn/autobackend.py of the component AutoBackend Model Loading. This manipulation of the argument imgsz/names/kpt_shape causes improper neutralization of directives in dynamically evaluated code. The attack requires local access. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-94 CWE-95

Affected software

Vendor	Product	Versions
Ultralytics	FastSAM	b4ed20c2fed75eadc5aa7d8b09fedd137b873b52

References

Timeline

Published: Oct 16, 2026
Last modified: Oct 21, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-111239The optional SSH administration service grants full access to the administration shell to every user that authenticates against its configur CVE-2026-111248.8Integer overflow in Skia in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially exploit heap corruption via a craf CVE-2026-111240The JDBC based JAAS login module accepts a login without a password for accounts whose stored password is NULL. A remote attacker who knows CVE-2026-111241When a non-default stateful session bean passivation strategy is configured, passivated bean state is written to predictably named files in CVE-2026-111242When MicroProfile JWT authentication is used for servlets that declare a run-as identity, the security state established for a request is no CVE-2026-111243A negative MicroProfile JWT clock skew setting is not rejected and disables validation of the token expiration and other time-based claims. CVE-2026-111244When MicroProfile JWT role-based access control is used, the access constraints of JAX-RS resources are not always enforced as declared: res CVE-2026-111245After a successful WS-Security UsernameToken authentication, the caller identity stays associated with the worker thread once the request co CVE-2026-111246The embedded OpenEJB HTTP server does not isolate HTTP sessions between web applications. A remote attacker can use a session established in CVE-2026-111247When resolving security roles of a realm-authenticated caller, the caller's user name is also treated as a role name in addition to the role CVE-2026-111248The Jakarta Security identity store backed by the Tomcat user database compares the supplied password with the stored value as plain text an CVE-2026-111249The development-time LiveReload support listens on all network interfaces without authentication and accepts websocket connections from any