CVE-2026-118683 MONAI 1.2.0 before 1.6.1 Code Execution via bundle configs/logging.conf

MONAI from 1.2.0 before 1.6.1 contains a remote code execution vulnerability in ConfigWorkflow.init, which passes a bundle's configs/logging.conf to logging.config.fileConfig that evals handler class and args fields. Attackers can publish a malicious bundle whose logging.conf runs arbitrary Pytho...

CVE-2026-118683

The MONAI library (versions 1.2.0 before 1.6.1 ) is vulnerable to remote code execution (RCE) within the ConfigWorkflow.__init__ function. The root cause is that the software passes a bundle's configs/logging.conf file to logging.config.fileConfig, which uses eval() to process handler class and a...