Description
A vulnerability was detected in iMoonLab yolov13 up to 73289949533efac82bb5f72ec19b746618656bd2. Affected by this issue is the function eval of the file ultralytics/nn/autobackend.py of the component AutoBackend Model Loading. Performing a manipulation of the argument imgsz/names/kpt_shape results in code injection. The attack must be initiated from a local position. The project was informed of the problem early through an issue report but has not responded yet.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| iMoonLab | yolov13 | 73289949533efac82bb5f72ec19b746618656bd2 | — |
References
- VDB-416770 | iMoonLab yolov13 AutoBackend Model Loading autobackend.py eval code injection vdb-entry technical-description
- VDB-416770 | CTI Indicators (IOB, IOC, TTP, IOA) signature permissions-required
- CVE-2026-108945 | CVE Analysis and Report third-party-advisory
- Submit #997729 | iMoonLab up to main commit 73289949533efac82bb5f72ec19b746618656bd2 Code Injection (CWE-94) third-party-advisory
- https://github.com/iMoonLab/yolov13/issues/81 issue-tracking
- https://github.com/iMoonLab/yolov13/ product