CVE-2026-111865 THU-MIG CVE debrief

Who should care

Defenders responsible for systems or deployments using THU-MIG yoloe should assess exposure and prioritize verification of the vulnerable component. They should also consider compensating controls or monitoring for potential exploitation attempts. The exploit has been released to the public and may be used for attacks. Defenders should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.

Why it matters

Defenders should prioritize verifying the presence of the vulnerable component and assessing exposure, as the exploit has been released to the public and may be used for attacks. The vulnerability allows for improper neutralization of directives in dynamically evaluated code, requiring a local approach for攻击. However, information about affected and unaffected releases is unavailable due to the product not using versioning.

• Verification of the presence of the vulnerable component is required
• Assessment of exposure to the vulnerability is necessary
• Potential for local attacks using the released exploit

Technical summary

The vulnerability affects the function eval of the file ultralytics/nn/autobackend.py of the component AutoBackend Model Loading in THU-MIG yoloe up to 40cd606cabdbe2b566d6f14a6b162c89206e9a1b, allowing for improper neutralization of directives in dynamically evaluated code. The manipulation of the argument imgsz/names/kpt_shape results in the vulnerability. The attack requires a local approach. This product does not use versioning, so information about affected and unaffected releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet. Defenders should prioritize verifying the presence of the vulnerable component and assessing exposure, as the

Defensive priority

Defenders should prioritize verifying the presence of the vulnerable component and assessing exposure, as the exploit has been released to the public and may be used for attacks.

Recommended defensive actions

• Verify the presence of the vulnerable component in the environment
• Assess exposure to the vulnerability
• Consider compensating controls or monitoring for potential exploitation attempts
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source metadata indicate a security flaw in THU-MIG yoloe, but information about affected and unaffected releases is unavailable due to the product not using versioning. Defenders should verify the presence of the vulnerable component and assess exposure, as the exploit has been released to the public and may be used for attacks. The vulnerability allows for improper neutralization of directives in dynamically evaluated code, requiring a local approach for attacks. However, the project was informed of the problem,

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.