CVE-2026-108945 PUBLISHED

iMoonLab yolov13 AutoBackend Model Loading autobackend.py eval code injection

Assigner: VulDB
Reserved: 11.10.2026 Published: 13.10.2026 Updated: 13.10.2026

A vulnerability was detected in iMoonLab yolov13 up to 73289949533efac82bb5f72ec19b746618656bd2. Affected by this issue is the function eval of the file ultralytics/nn/autobackend.py of the component AutoBackend Model Loading. Performing a manipulation of the argument imgsz/names/kpt_shape results in code injection. The attack must be initiated from a local position. The project was informed of the problem early through an issue report but has not responded yet.

Metrics

CVSS Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X
CVSS Score: 4.8

Product Status

Vendor iMoonLab
Product yolov13
Versions
  • Version 73289949533efac82bb5f72ec19b746618656bd2 is affected

Credits

  • dem0000 (VulDB User) reporter
  • VulDB CNA Team coordinator

References

Problem Types

  • Code Injection CWE
  • Injection CWE