A security vulnerability has been detected in WongKinYiu yolov9 0.1. (CVE-2026-111991)

The vulnerability in WongKinYiu yolov9 0.1 affects the DetectMultiBackend.__init__ function in models/common.py, part of the ONNX Metadata Handler. It allows code injection through manipulation of the argument names/stride parameters. Remote attackers can exploit this flaw. The issue was reported early to the project, but no response or patch has been provided. The CVSS 3.1 score is 6.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and low impacts on confidentiality, integrity, and availability.

Successful exploitation can lead to code injection, potentially allowing an attacker to execute arbitrary code remotely. The impact on confidentiality, integrity, and availability is rated low. The vulnerability requires user interaction and has low attack complexity, making exploitation feasible but not trivial. No known exploits are currently active in the wild.

No official fix or patch is currently available as the project has not responded to the issue report. Users should monitor the project for updates and advisories. Until a patch is released, avoid using the affected function with untrusted input, especially the argument names/stride parameters, to mitigate risk.