# CVE-2026-111865: THU-MIG yoloe code injection in AutoBackend model loading

Source: https://junglewise.ai/threats/cve-2026-111865-a-security-flaw-has-been-discovered-in-thu-mig-yoloe-up-to  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-17. Updated: 2026-10-17  
License: CC BY 4.0 with a link back

CVE-2026-111865 · Severity: medium · CVSS 5.3 · Published 2026-10-17

YOLOE is an object detection framework that loads neural network models in ONNX format. The bundled ultralytics library uses eval() to parse model metadata fields instead of safely evaluating them, allowing attackers to execute arbitrary Python code when loading a malicious model file. An attacker with the ability to provide a model file can gain full code execution with the privileges of the loading process.

Technologies: [Ultralytics](https://junglewise.ai/threats/technologies/ultralytics-ultralytics). Vendors: [Ultralytics](https://junglewise.ai/threats/vendors/ultralytics).

## Quick answers

**Is CVE-2026-111865 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-111865 being exploited in the wild.

**How severe is CVE-2026-111865?** Medium severity, with a CVSS score of 5.3, published 17 October 2026.

**Which products and versions are affected?** THU-MIG Yoloe up to commit 40cd606cabdbe2b566d6f14a6b162c89206e9a1b; no versioning used; Ultralytics 8.3.39 (bundled in yoloe).

**Is there a fix for CVE-2026-111865?** No fixed version is recorded yet. Update the bundled ultralytics library to version 8.3.234 or later, or apply the one-line patch replacing eval(v) with ast.literal_eval(v) in ultralytics/nn/autobackend.py line 483.</anigation>
<parameter name="timeline">[{"kind":"disclosed","at":"2026-09-29","note":"Security issue reported on GitHub"},{"kind":"advisory","at":"2026-10-17","note":"CVE-2026-111865 published"}] If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-111865 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-111865?** Check whether you run THU-MIG Yoloe or Ultralytics at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Update the bundled ultralytics library to version 8.3.234 or later, or apply the one-line patch replacing eval(v) with ast.literal_eval(v) in ultralytics/nn/autobackend.py line 483.</anigation>
<parameter name="timeline">[{"kind":"disclosed","at":"2026-09-29","note":"Security issue reported on GitHub"},{"kind":"advisory","at":"2026-10-17","note":"CVE-2026-111865 published"}]

## Technical details

The vulnerability exists in ultralytics/nn/autobackend.py where ONNX model metadata strings (imgsz, names, kpt_shape) are evaluated using Python's eval() function without validation or sandboxing. An attacker can craft a malicious .onnx file containing arbitrary Python expressions in metadata_props to achieve remote code execution when the model is loaded via AutoBackend(). The fix is to replace eval() with ast.literal_eval().

## Affected products

- THU-MIG yoloe up to commit 40cd606cabdbe2b566d6f14a6b162c89206e9a1b; no versioning used
- Ultralytics ultralytics 8.3.39 (bundled in yoloe)

## References

- [https://github.com/THU-MIG/yoloe/](https://github.com/THU-MIG/yoloe/)
- [https://github.com/THU-MIG/yoloe/issues/148](https://github.com/THU-MIG/yoloe/issues/148)

## Related threats

- [Ultralytics Google Drive download path traversal remote code execution](https://junglewise.ai/threats/cve-2026-118619-ultralytics-google-drive-download-path-traversal-remote-code)
- [Ultralytics parse_model code injection remote code execution](https://junglewise.ai/threats/cve-2026-118618-ultralytics-parse-model-code-injection-remote-code-execution)
- [Ultralytics load_dataset_cache_file deserialization of untrusted data](https://junglewise.ai/threats/cve-2026-118617-ultralytics-load-dataset-cache-file-deserialization-of-untrusted)
- [Ultralytics parse_model code injection remote code execution](https://junglewise.ai/threats/cve-2026-118616-ultralytics-parse-model-code-injection-remote-code-execution)
- [Ultralytics torch_safe_load command injection remote code execution](https://junglewise.ai/threats/cve-2026-118615-ultralytics-torch-safe-load-command-injection-remote-code)