CVE-2026-111991

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-111991

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111991.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-111991

Published

2026-10-18T15:00:15Z

Modified

2026-10-19T02:45:45Z

Severity

2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

WongKinYiu yolov9 ONNX Metadata common.py DetectMultiBackend.__init__ code injection

Details

A security vulnerability has been detected in WongKinYiu yolov9 0.1. This vulnerability affects the function DetectMultiBackend.init of the file models/common.py of the component ONNX Metadata Handler. The manipulation of the argument names/stride leads to code injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Database specific

{
    "cna_assigner":  "VulDB",
    "cwe_ids":  [
        "CWE-74",
        "CWE-94"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111991.json"
}

References

Affected packages

Git / github.com/wongkinyiu/yolov9

Affected ranges

Type

GIT

Repo

https://github.com/wongkinyiu/yolov9

Events

Introduced

5b10b5099005a45332ebe7669f8480d5fc791a65

Last Affected

5b10b5099005a45332ebe7669f8480d5fc791a65

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "0.1"
        },
        {
            "last_affected":  "0.1"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

0.*

0.1

v0.*

v0.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111991.json"