Ultralytics CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM Ultralytics CVE published 2026-10-16

CVE-2026-111237

A weakness in Ultralytics FastSAM up to b4ed20c2fed75eadc5aa7d8b09fedd137b873b52 allows for improper neutralization of directives in dynamically evaluated code due to manipulation of the imgsz/names/kpt_shape argument in the session.get_modelmeta.custom_metadata_map function of the ultralytics/nn/autobackend.py file. This requires local access and is related to CWE-94 and CWE-95.