CVE-2026-108945 iMoonLab CVE debrief

Who should care

Defenders responsible for iMoonLab yolov13 deployments should assess exposure and prioritize patching or mitigation to prevent local code injection attacks. This includes operators, platform administrators, vulnerability management teams, and security teams who need to verify the affected version and apply patches or mitigations.

Why it matters

CVE-2026-108945 is a code injection vulnerability in iMoonLab yolov13 that allows for local code injection attacks. Defenders should prioritize verifying the affected version and applying patches or mitigations to prevent local code injection attacks.

• Verify and apply patches or mitigations to prevent local code injection attacks.
• Restrict access to the affected component and monitor for suspicious activity.
• Implement additional security controls to prevent code injection attacks.

Technical summary

The vulnerability is caused by a lack of proper input validation in the eval function of the ultralytics/nn/autobackend.py file. An attacker can inject malicious code by manipulating the imgsz/names/kpt_shape argument, allowing for code injection attacks. This vulnerability affects iMoonLab yolov13 up to version 73289949533efac82bb5f72ec19b746618656bd2, specifically in the AutoBackend Model Loading component. Defenders should prioritize verifying the affected version and applying patches or mitigations to prevent local code injection attacks.

Defensive priority

Defenders should prioritize verifying the affected version and applying patches or mitigations to prevent local code injection attacks.

Recommended defensive actions

• Verify the affected version of iMoonLab yolov13 and apply patches or mitigations to prevent local code injection attacks.
• Restrict access to the affected component and monitor for suspicious activity.
• Implement additional security controls to prevent code injection attacks.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The vulnerability was detected in iMoonLab yolov13 up to version 73289949533efac82bb5f72ec19b746618656bd2. The affected component is AutoBackend Model Loading, and the eval function in ultralytics/nn/autobackend.py is vulnerable to code injection.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.