Threats affecting pkg:pypi/ultralytics

CVE-2026-118619 is a path traversal vulnerability in Ultralytics version 8.4.103 related to handling downloads from Google Drive. It allows remote attackers to execute arbitrary code by supplying a crafted path that is not properly validated before file operations. Exploitation requires user interaction, such as visiting a malicious page or opening a malicious file. The vulnerability has a high severity with a CVSS score of 8.8.

CVE-2026-118618 is a code injection vulnerability in the parse_model function of Ultralytics version 8.4.65. It allows remote attackers to execute arbitrary Python code by supplying a malicious string that is not properly validated before execution. Exploitation requires user interaction, such as visiting a malicious page or opening a malicious file. The vulnerability has a high severity with a CVSS score of 7.8.

CVE-2026-118617 is a high-severity vulnerability in Ultralytics version 8.4.65 involving deserialization of untrusted data in the load_dataset_cache_file function. This flaw allows remote attackers to execute arbitrary code if a user interacts with malicious content, such as visiting a crafted page or opening a malicious file. The vulnerability arises from improper validation of user-supplied data, enabling code execution in the context of the current user.

CVE-2026-118616 is a code injection vulnerability in the parse_model function of Ultralytics version 8.4.65. It allows remote attackers to execute arbitrary Python code by supplying a malicious string that is not properly validated before execution. Exploitation requires user interaction, such as visiting a malicious page or opening a malicious file. The vulnerability has a high severity rating with a CVSS score of 7.8.

CVE-2026-118615 is a high-severity OS command injection vulnerability in the Ultralytics product, specifically in the torch_safe_load function. This flaw allows remote attackers to execute arbitrary code by supplying malicious input that is improperly validated before being used in a system call. Exploitation requires user interaction, such as visiting a malicious webpage or opening a malicious file. The vulnerability affects version 8.4.65 of Ultralytics.

CVE-2026-118614 is a code injection vulnerability in the Ultralytics software, specifically in the check_det_dataset function. This flaw allows remote attackers to execute arbitrary Python code by supplying a malicious string that is not properly validated before execution. Exploitation requires user interaction, such as visiting a malicious webpage or opening a malicious file. The vulnerability affects version 8.4.65 of Ultralytics and has a high severity rating with a CVSS score of 7.8.

CVE-2026-118613 is a high-severity vulnerability in Ultralytics version 8.4.65 involving deserialization of untrusted data in the torch_load function. This flaw allows remote attackers to execute arbitrary code if a user interacts with malicious content, such as visiting a crafted page or opening a malicious file. The vulnerability arises from improper validation of user-supplied data during deserialization, enabling code execution in the context of the current user.