Ultralytics vulnerabilities

Products

• Ultralytics 7
• fastsam 1
• ultralytics/actions 1
• yolov3 1
• yolov5 1

Latest Ultralytics CVEs

Newest publication first

1. CVE-2026-118619 Ultralytics Google Drive Download Path Traversal Remote Code Execution Vulnerability

   Published 2026-10-28

   High·CVSS 8.8 EPSS 0.53%

   Ultralytics Google Drive Download Path Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must...

2. CVE-2026-118618 Ultralytics parse_model Code Injection Remote Code Execution Vulnerability

   Published 2026-10-28

   High·CVSS 7.8 EPSS 0.22%

   Ultralytics parse_model Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a ma...

3. CVE-2026-118617 Ultralytics load_dataset_cache_file Deserialization of Untrusted Data Remote Code Execution Vulnerability

   Published 2026-10-28

   High·CVSS 7.8 EPSS 0.26%

   Ultralytics load_dataset_cache_file Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in...

4. CVE-2026-118616 Ultralytics parse_model Code Injection Remote Code Execution Vulnerability

   Published 2026-10-28

   High·CVSS 7.8 EPSS 0.20%

   Ultralytics parse_model Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a ma...

5. CVE-2026-118615 Ultralytics torch_safe_load Command Injection Remote Code Execution Vulnerability

   Published 2026-10-28

   High·CVSS 7.8 EPSS 0.41%

   Ultralytics torch_safe_load Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must vis...

6. CVE-2026-118614 Ultralytics check_det_dataset Code Injection Remote Code Execution Vulnerability

   Published 2026-10-28

   High·CVSS 7.8 EPSS 0.20%

   Ultralytics check_det_dataset Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visi...

7. CVE-2026-118613 Ultralytics torch_load Deserialization of Untrusted Data Remote Code Execution Vulnerability

   Published 2026-10-28

   High·CVSS 7.8 EPSS 0.24%

   Ultralytics torch_load Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the targ...

8. CVE-2026-111237 Ultralytics FastSAM AutoBackend Model Loading autobackend.py session.get_modelmeta.custom_metadata_map eval injection

   Published 2026-10-16

   Medium·CVSS 4.8 EPSS 0.12%

   A weakness has been identified in Ultralytics FastSAM up to b4ed20c2fed75eadc5aa7d8b09fedd137b873b52. This affects the function session.get_modelmeta.custom_metadata_map of the file ultralytics/nn/autobackend.py of the component AutoBackend Model Loading. This manipulation of the...

9. GHSA-7x29-qqmq-v6qc GitHub Actions Script Injection in `ultralytics/actions`

   Published 2024-08-14

   High·CVSS 7.8

   Summary The Ultralytics action available at https://github.com/marketplace/actions/ultralytics-actions is vulnerable to GitHub Actions script injection. If anyone uses the action within a workflow that runs on the pull_request_target trigger, then an attacker can inject arbitrary...

10. CVE-2021-31681 Deserialization of Untrusted Data vulnerability in yolo 3 allows attackers to execute arbitrary code via crafted yaml file.

    Published 2023-07-31

    High·CVSS 7.8 EPSS 0.42%

    Deserialization of Untrusted Data vulnerability in yolo 3 allows attackers to execute arbitrary code via crafted yaml file.

11. CVE-2021-31680 Deserialization of Untrusted Data vulnerability in yolo 5 allows attackers to execute arbitrary code via crafted yaml file.

    Published 2023-07-31

    High·CVSS 7.8 EPSS 0.42%

    Deserialization of Untrusted Data vulnerability in yolo 5 allows attackers to execute arbitrary code via crafted yaml file.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.