CVE-2026-118616 is a code injection vulnerability in the parse_model function of Ultralytics software. It allows remote attackers to execute arbitrary Python code by supplying a crafted string that is not properly validated before execution. Exploitation requires user interaction, such as visiting a malicious webpage or opening a malicious file. The vulnerability has a high severity with a CVSS score of 7.8.