Ultralytics parse_model code injection zero-day enables remote code execution
Victims must visit a malicious page or open a file; ZDI scores ZDI-26-817 at CVSS 7.8.
55
Vendor
Ultralytics
- Mentions · 7d7
- Mentions · 30d7
- All mentions7
- First seenOct 28, 2026
- Last mentioned2d ago
Timeline
7 articles · newest firstUltralytics parse_model code injection allows remote code execution (ZDI-26-815)
ZDI rates the unpatched flaw 7.8; a victim must open a malicious file or visit a malicious page.
58
Ultralytics Google Drive path traversal zero-day can run attacker code
A user must open a malicious page or file; ZDI rates ZDI-26-818 at CVSS 8.8.
58
Ultralytics cache deserialization zero-day can execute remote code
Opening a malicious page or file is required; ZDI rates ZDI-26-816 at CVSS 7.8.
55
Ultralytics torch_load untrusted deserialization leads to remote code execution
ZDI-26-812 scores 7.8 and needs a user to open a malicious file or visit a malicious page.
58
Ultralytics torch_safe_load command injection enables remote code execution
ZDI-26-814 is an unpatched CVSS 7.8 flaw that needs a user to open a file or visit a page.
58
Ultralytics check_det_dataset code injection can run remote code
ZDI-26-813 is a CVSS 7.8 zero-day that requires opening a malicious file or page.
58
Appears with
- Zero Day Initiativeorganization · 7
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.