iMoonLab CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM iMoonLab CVE published 2026-10-13

CVE-2026-108945

A code injection vulnerability was detected in iMoonLab yolov13 up to version 73289949533efac82bb5f72ec19b746618656bd2, affecting the AutoBackend Model Loading component. The vulnerability is triggered by manipulating the imgsz/names/kpt_shape argument in the eval function of the ultralytics/nn/autobackend.py file, allowing for code injection attacks. The attack must be initiated from a local position.