CVE-2026-118618 is a code injection vulnerability in the parse_model function of Ultralytics software. It allows remote attackers to execute arbitrary Python code by supplying a malicious string that is improperly validated before execution. Exploitation requires user interaction, such as visiting a malicious page or opening a malicious file. The vulnerability can lead to full compromise of the affected system under the current user's privileges.