{"id":"CVE-2026-108945","summary":"iMoonLab yolov13 AutoBackend Model Loading autobackend.py eval code injection","details":"A vulnerability was detected in iMoonLab yolov13 up to 73289949533efac82bb5f72ec19b746618656bd2. Affected by this issue is the function eval of the file ultralytics/nn/autobackend.py of the component AutoBackend Model Loading. Performing a manipulation of the argument imgsz/names/kpt_shape results in code injection. The attack must be initiated from a local position. The project was informed of the problem early through an issue report but has not responded yet.","modified":"2026-10-14T02:47:08.681261028Z","published":"2026-10-13T00:45:11.214Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/108xxx/CVE-2026-108945.json","cna_assigner":"VulDB","cwe_ids":["CWE-74","CWE-94"]},"references":[{"type":"WEB","url":"https://github.com/iMoonLab/yolov13/"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/108xxx/CVE-2026-108945.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108945"},{"type":"ADVISORY","url":"https://vuldb.com/cve/CVE-2026-108945"},{"type":"ADVISORY","url":"https://vuldb.com/submit/997729"},{"type":"ADVISORY","url":"https://vuldb.com/vuln/416770"},{"type":"REPORT","url":"https://github.com/iMoonLab/yolov13/issues/81"},{"type":"REPORT","url":"https://vuldb.com/vuln/416770/cti"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/imoonlab/yolov13","events":[{"introduced":"73289949533efac82bb5f72ec19b746618656bd2"},{"last_affected":"73289949533efac82bb5f72ec19b746618656bd2"}]}],"versions":["73289949533efac82bb5f72ec19b746618656bd2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-108945.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X"}]}