(0Day) Ultralytics check_det_dataset Code Injection Remote Code Execution (CVE‑2026‑118614)
What It Is — The Zero Day Initiative disclosed a remote code execution flaw in the check_det_dataset function of Ultralytics’ Python library. The function fails to validate a user‑supplied string before passing it to Python’s exec engine, allowing an attacker who can convince a victim to open a malicious page or file to run arbitrary code in the context of the current user. The vulnerability carries a CVSS 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) rating. Ultralytics was notified on 18 June 2026; the advisory was publicly released on 28 Oct 2026 after the vendor did not issue a patch. Mitigation is limited to restricting any untrusted interaction with the library until a fix is available.
Affected Products — Ultralytics Python library (any version containing the check_det_dataset function).
Why It Matters for Trust & Control Assurance — This flaw highlights the need for robust secure‑development controls—particularly input validation and code‑review processes—that satisfy a single control objective across many frameworks (e.g., NIST CSF 2.0’s “Secure Software Development” practice).
Recommended Actions
- Block or isolate environments that run the vulnerable function until a vendor patch is released.
- Enforce strict input‑validation and code‑review policies for any custom extensions to the library.
- Deploy runtime monitoring to detect unexpected process execution or privilege escalation.
- Maintain an inventory of third‑party libraries and map them to your control framework for continuous assurance.