CVE-2026-111212 ImprintLab CVE debrief

Who should care

Defenders responsible for ImprintLab Medical-SAM-Adapter deployments, security teams, and vulnerability management teams should assess exposure and prioritize verification and compensating controls. They should also review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.

Why it matters

CVE-2026-111212 is a security flaw in ImprintLab Medical-SAM-Adapter 0.1.0-alpha/0.1.0 that allows for improper neutralization of directives in dynamically evaluated code, requiring local approach for exploitation. Defenders should prioritize verifying affected versions, assessing exposure, and applying compensating controls.

• Verification of affected versions and configurations is required
• Assessment of exposure to local attacks is necessary
• Application of compensating controls may be necessary

Technical summary

The vulnerability affects the function session.get_modelmeta.custom_metadata_map in the file models/MobileSAMv2/ultralytics/nn/autobackend.py of the AutoBackend Model Loading component. The manipulation of the arguments imgsz/names/kpt_shape results in improper neutralization of directives in dynamically evaluated code. This issue requires a local approach for exploitation and has been publicly disclosed. Defenders should prioritize verifying affected versions, assessing exposure, and applying compensating controls.

Defensive priority

Defenders should prioritize verifying the affected versions and configurations of ImprintLab Medical-SAM-Adapter, assessing exposure, and applying compensating controls.

Recommended defensive actions

• Verify the affected versions and configurations of ImprintLab Medical-SAM-Adapter
• Assess exposure and apply compensating controls
• Monitor for potential local attacks
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details about the vulnerability, but the corpus lacks specific information on affected versions, exploitation, and remediation. Defenders should verify affected versions, assess exposure, and apply compensating controls based on available information. Limited source detail suggests explicit evidence-limit language and defensive verification tasks are necessary.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.