Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.4

yolov9 can be tricked into running remote code

CVE-2026-111991 · published today
Summary

The yolov9 version 0.1 model contains a flaw in its ONNX metadata handling that lets an attacker insert malicious code when the system processes certain inputs. This could allow an attacker to run arbitrary commands on the server from a distance. Update to a fixed version or disable the vulnerable component until a patch is applied.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
wongkinyiu yolov9 0.1
Original advisory text
WongKinYiu yolov9 ONNX Metadata common.py DetectMultiBackend.__init__ code injection
A security vulnerability has been detected in WongKinYiu yolov9 0.1. This vulnerability affects the function DetectMultiBackend.__init__ of the file models/common.py of the component ONNX Metadata Handler. The manipulation of the argument names/stride leads to code injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
8.4 High
Type
CWE-74Injection
CWE-94Code Injection
Timeline
Published18 Oct 2026
Updated19 Oct 2026
First seen18 Oct 2026
Sources
CVE-2026-111991 · NVD
CVE-2026-111991 · MITRE
CVE-2026-111991 · OSV
Track software like this
Free during beta