CVE-2026-111991: YOLOv9: code injection via ONNX metadata names/stride

A code injection flaw in YOLOv9 0.1 lets a crafted ONNX model's metadata (the names and stride fields) inject code into DetectMultiBackend.__init__ when the model is loaded. The score is medium (CVSS 6.3) and exploitation requires user interaction, which in practice means someone loading an attacker-supplied model. EPSS is low (0.00312, top 77% percentile), the CVE is not in CISA KEV, and there is no known public exploit or Nuclei template. NVD-style data lists a public disclosure, though, and the maintainers have not responded to the issue report, so a vendor patch should not be assumed. Until a fix ships, only load ONNX models from trusted, verified sources, and run inference in sandboxed environments with minimal privileges.

No confirmed active exploitation of CVE-2026-111991 has been reported, but organizations should still patch proactively.

1) No vendor fix is known; monitor the upstream repository and issue #670 for a patch and pin to a fixed commit once available. 2) Only load ONNX models from trusted, integrity-checked sources (hash or signature verification) and block user-supplied model uploads. 3) Run model loading and inference in sandboxed containers with no network egress, read-only filesystems and least-privilege credentials. 4) Review models for suspicious metadata in the names and stride properties, since these values are used in code evaluation. 5) As a code-level workaround, replace eval-style parsing of ONNX metadata with safe parsing such as ast.literal_eval or JSON, and validate types. 6) Monitor for unexpected child processes or outbound connections from inference workers.

This vulnerability affects the following AI/ML architecture patterns: model serving, computer vision inference, edge inference, training and evaluation pipelines.

CVE-2026-111991 has a CVSS v3.1 base score of 6.3 (MEDIUM). The EPSS exploitation probability is 0.38%.