{"vulnerability": "cve-2026-111237", "sightings": [{"uuid": "479f9180-6447-416e-967b-ab4123f81a9e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-111237", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117447930356631127", "content": "CVE-2026-111237 Ultralytics FastSAM AutoBackend Model Loading autobackend.py session.get_modelmeta.custom_metadata_map eval injection A weakness has been identified in Ultralytics FastSAM up to b4ed20c2fed75eadc5aa7d8b09fedd137b873b52. This affects the function session.get_modelmeta.custom_metadata_map of the file ultralytics/nn/autobackend.py of the component AutoBackend Model Loading. This manipulation of the argument imgsz/names/kpt_shape causes improper neutralization of directives in dynamically evaluated code. The attack requires local access. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.\nhttps://www.cve.org/CVERecord?id=CVE-2026-111237https://vuldb.com/vuln/420764https://vuldb.com/vuln/420764/ctihttps://vuldb.com/cve/CVE-2026-111237https://vuldb.com/submit/1004882https://github.com/CASIA-LMC-Lab/FastSAM/issues/288#Ultralytics #FastSAM#CVE_2026_111237#bot", "creation_timestamp": "2026-10-16T01:13:15.708211Z"}]}