CVE-2026-118615 is a command injection vulnerability in the torch_safe_load function of Ultralytics software. It allows remote attackers to execute arbitrary code by supplying a malicious string that is improperly validated before being used in a system call. Exploitation requires user interaction, such as visiting a malicious webpage or opening a malicious file. The vulnerability has a high severity with a CVSS score of 7.8.