384 matches found
CVE-2026-119578
MONAI from 1.6.0 before 1.6.1 contains a remote code execution vulnerability in Auto3DSeg algofromjson that allows attackers to run Python code via a crafted work directory's algoobject.json. Attackers can ship a malicious algorithmtemplates module plus a target name that is imported and...
CVE-2026-119578 MONAI 1.6.0 before 1.6.1 Code Execution via Auto3DSeg algo_from_json()
MONAI from 1.6.0 before 1.6.1 contains a remote code execution vulnerability in Auto3DSeg algofromjson that allows attackers to run Python code via a crafted work directory's algoobject.json. Attackers can ship a malicious algorithmtemplates module plus a target name that is imported and...
EUVD-2026-113932
MONAI from 1.6.0 before 1.6.1 contains a remote code execution vulnerability in Auto3DSeg algofromjson that allows attackers to run Python code via a crafted work directory's algoobject.json. Attackers can ship a malicious algorithmtemplates module plus a target name that is imported and...
CVE-2026-119578
Versions 1.6.0 before 1.6.1 of MONAI are vulnerable to Remote Code Execution within the Auto3DSeg algo_from_json() function. The root cause is Unsafe Reflection (CWE-470), where a crafted algo_object.json in a work directory can cause the system to import and instantiate a malicious algorithm_tem...
CVE-2026-119578 MONAI 1.6.0 before 1.6.1 Code Execution via Auto3DSeg algo_from_json()
MONAI from 1.6.0 before 1.6.1 contains a remote code execution vulnerability in Auto3DSeg algofromjson that allows attackers to run Python code via a crafted work directory's algoobject.json. Attackers can ship a malicious algorithmtemplates module plus a target name that is imported and...
PT-2026-133547
MONAI from 1.6.0 before 1.6.1 contains a remote code execution vulnerability in Auto3DSeg algo from json that allows attackers to run Python code via a crafted work directory's algo object.json. Attackers can ship a malicious algorithm templates module plus a target name that is imported and...
CVE-2026-118684
MONAI before 1.6.1 contains an insufficient integrity verification vulnerability in checkhash that silently returns True when hashval is None, with MD5 as the default hash type. Attackers performing man-in-the-middle or registry compromise can substitute bundles, datasets, or model archives...
CVE-2026-118683
MONAI from 1.2.0 before 1.6.1 contains a remote code execution vulnerability in ConfigWorkflow.init, which passes a bundle's configs/logging.conf to logging.config.fileConfig that evals handler class and args fields. Attackers can publish a malicious bundle whose logging.conf runs arbitrary Pytho...
CVE-2026-118684 MONAI before 1.6.1 Missing Integrity Verification via check_hash in Downloads
MONAI before 1.6.1 contains an insufficient integrity verification vulnerability in checkhash that silently returns True when hashval is None, with MD5 as the default hash type. Attackers performing man-in-the-middle or registry compromise can substitute bundles, datasets, or model archives...
CVE-2026-118684 MONAI before 1.6.1 Missing Integrity Verification via check_hash in Downloads
MONAI before 1.6.1 contains an insufficient integrity verification vulnerability in checkhash that silently returns True when hashval is None, with MD5 as the default hash type. Attackers performing man-in-the-middle or registry compromise can substitute bundles, datasets, or model archives...
CVE-2026-118684
Versions of MONAI before 1.6.1 are vulnerable to an insufficient integrity verification flaw in the check_hash() function. The vulnerability occurs because the function silently returns True when the hash_val is None , and it uses MD5 as the default hash type. This allows attackers to perform man...
EUVD-2026-112389
MONAI before 1.6.1 contains an insufficient integrity verification vulnerability in checkhash that silently returns True when hashval is None, with MD5 as the default hash type. Attackers performing man-in-the-middle or registry compromise can substitute bundles, datasets, or model archives...
EUVD-2026-112388
MONAI from 1.2.0 before 1.6.1 contains a remote code execution vulnerability in ConfigWorkflow.init, which passes a bundle's configs/logging.conf to logging.config.fileConfig that evals handler class and args fields. Attackers can publish a malicious bundle whose logging.conf runs arbitrary Pytho...
CVE-2026-118683
The MONAI library (versions 1.2.0 before 1.6.1 ) is vulnerable to remote code execution (RCE) within the ConfigWorkflow.__init__ function. The root cause is that the software passes a bundle's configs/logging.conf file to logging.config.fileConfig, which uses eval() to process handler class and a...
CVE-2026-118683 MONAI 1.2.0 before 1.6.1 Code Execution via bundle configs/logging.conf
MONAI from 1.2.0 before 1.6.1 contains a remote code execution vulnerability in ConfigWorkflow.init, which passes a bundle's configs/logging.conf to logging.config.fileConfig that evals handler class and args fields. Attackers can publish a malicious bundle whose logging.conf runs arbitrary Pytho...
CVE-2026-118683 MONAI 1.2.0 before 1.6.1 Code Execution via bundle configs/logging.conf
MONAI from 1.2.0 before 1.6.1 contains a remote code execution vulnerability in ConfigWorkflow.init, which passes a bundle's configs/logging.conf to logging.config.fileConfig that evals handler class and args fields. Attackers can publish a malicious bundle whose logging.conf runs arbitrary Pytho...
CVE-2026-118683: Improper Control of Generation of Code
MONAI from 1.2.0 before 1.6.1 contains a remote code execution vulnerability in ConfigWorkflow.init, which passes a bundle's configs/logging.conf to logging.config.fileConfig that evals handler class and args fields. Attackers can publish a malicious bundle whose logging.conf runs arbitrary Pytho...
PT-2026-129157
MONAI before 1.6.1 contains an insufficient integrity verification vulnerability in check hash that silently returns True when hash val is None, with MD5 as the default hash type. Attackers performing man-in-the-middle or registry compromise can substitute bundles, datasets, or model archives...
PT-2026-129156
MONAI from 1.2.0 before 1.6.1 contains a remote code execution vulnerability in ConfigWorkflow. init , which passes a bundle's configs/logging.conf to logging.config.fileConfig that evals handler class and args fields. Attackers can publish a malicious bundle whose logging.conf runs arbitrary...
CVE-2026-109360
MONAI 0.4.0 before 1.6.1 contains a remote code execution vulnerability that allows on-path attackers to execute code by tampering with SENet pretrained weights fetched over plaintext HTTP. Attackers can substitute a crafted .pth file that loadstatedictfromurl unpickles without weightsonly=True,...