MAL-2026-17193 Malicious code in metrio (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ce8ee66a844d7abed74f4b9d223c8ef8f35bae380104526f4f8bc57295c47320 metrio 999.0.0 executes a hostname-exfiltration beacon from both setup.py install time and metrio/init.py import time. The code reads the local...

Malicious code in metrio (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ce8ee66a844d7abed74f4b9d223c8ef8f35bae380104526f4f8bc57295c47320 metrio 999.0.0 executes a hostname-exfiltration beacon from both setup.py install time and metrio/init.py import time. The code reads the local...

deep-labelprop (0.1.0), monailabel-weekly (0.1.0.dev2128) +2 more potentially affected by CVE-2026-100846 via monai (0.6.0)

monai PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on monai and may be impacted: - deep-labelprop 0.1.0 - monailabel-weekly 0.1.0.dev2128 - p-mod-api 0.0.2 - p2022 0.0.4 Source cves: CVE-2026-100846 Source advisory: OSV:PYSEC-2026-40...

deep-labelprop (1.1.1), fastmonai (>=0.1.0, <=0.1.4) +5 more potentially affected by CVE-2026-100846 via monai (0.8.1)

monai PYPI version 0.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on monai and may be impacted: - deep-labelprop 1.1.1 - fastmonai =0.1.0, =0.0.2, =0.0.3, =0.4.0.dev2201, =0.4.0.dev2208 Source cves: CVE-2026-100846 Source advisory: OSV:PYSEC-2026-4...

2404-segmentation-pipeline (>=0.1.0, <=1.0.0), abdomenatlas (>=0.1.0, <=0.1.1) +38 more potentially affected by CVE-2026-100845 via monai (>=1.0.0, <=1.5.2)

monai PYPI version =1.0.0, =0.1.0, =0.1.0, =0.0.1, =1.0.0rc1, =0.0.1, =0.1.5, =0.0.5, =0.1.5, =0.0.3, =6.0.0rc1, =0.1.1, =1.0.1a4, =1.0.1a5 and more Source cves: CVE-2026-100845 Source advisory: OSV:PYSEC-2026-4020...

monailabel (0.4.1), monailabel-weekly (0.4.0.dev2228) +2 more potentially affected by CVE-2026-100846 via monai (0.9.0)

monai PYPI version 0.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on monai and may be impacted: - monailabel 0.4.1 - monailabel-weekly 0.4.0.dev2228 - neurips-cellseg-gc =0.0.1, =0.1.5, =0.1.10 Source cves: CVE-2026-100846 Source advisory:...

deep-labelprop (1.1.1), fastmonai (>=0.1.0, <=0.1.4) +5 more potentially affected by CVE-2026-100845 via monai (0.8.1)

monai PYPI version 0.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on monai and may be impacted: - deep-labelprop 1.1.1 - fastmonai =0.1.0, =0.0.2, =0.0.3, =0.4.0.dev2201, =0.4.0.dev2208 Source cves: CVE-2026-100845 Source advisory: OSV:PYSEC-2026-4...

fedbiomed-cli (>=0.1.2, <=0.1.8) potentially affected by CVE-2026-100846 via monai (0.4.0)

monai PYPI version 0.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on monai and may be impacted: - fedbiomed-cli =0.1.2, =0.1.8 Source cves: CVE-2026-100846 Source advisory: OSV:PYSEC-2026-4021...

monailabel (0.4.1), monailabel-weekly (0.4.0.dev2228) +2 more potentially affected by CVE-2026-100845 via monai (0.9.0)

monai PYPI version 0.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on monai and may be impacted: - monailabel 0.4.1 - monailabel-weekly 0.4.0.dev2228 - neurips-cellseg-gc =0.0.1, =0.1.5, =0.1.10 Source cves: CVE-2026-100845 Source advisory:...

magms (>=1.1.0, <=2.0.2) potentially affected by CVE-2026-100846 via monai (0.9.1)

monai PYPI version 0.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on monai and may be impacted: - magms =1.1.0, =2.0.2 Source cves: CVE-2026-100846 Source advisory: OSV:PYSEC-2026-4021...

fedbiomed-cli (>=0.1.2, <=0.1.8) potentially affected by CVE-2026-100845 via monai (0.4.0)

monai PYPI version 0.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on monai and may be impacted: - fedbiomed-cli =0.1.2, =0.1.8 Source cves: CVE-2026-100845 Source advisory: OSV:PYSEC-2026-4020...

deep-labelprop (0.1.0), monailabel-weekly (0.1.0.dev2128) +2 more potentially affected by CVE-2026-100844 via monai (0.6.0)

monai PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on monai and may be impacted: - deep-labelprop 0.1.0 - monailabel-weekly 0.1.0.dev2128 - p-mod-api 0.0.2 - p2022 0.0.4 Source cves: CVE-2026-100844 Source advisory: OSV:PYSEC-2026-40...

fedbiomed-cli (>=0.1.2, <=0.1.8) potentially affected by CVE-2026-100844 via monai (0.4.0)

monai PYPI version 0.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on monai and may be impacted: - fedbiomed-cli =0.1.2, =0.1.8 Source cves: CVE-2026-100844 Source advisory: OSV:PYSEC-2026-4019...

2404-segmentation-pipeline (>=0.1.0, <=1.0.0), abdomenatlas (>=0.1.0, <=0.1.1) +38 more potentially affected by CVE-2026-100844 via monai (>=1.0.0, <=1.5.2)

monai PYPI version =1.0.0, =0.1.0, =0.1.0, =0.0.1, =1.0.0rc1, =0.0.1, =0.1.5, =0.0.5, =0.1.5, =0.0.3, =6.0.0rc1, =0.1.1, =1.0.1a4, =1.0.1a5 and more Source cves: CVE-2026-100844 Source advisory: OSV:PYSEC-2026-4019...

monailabel (>=0.2.0rc2, <=0.2.0), monailabel-weekly (>=0.3.0.dev2139, <=0.3.0.dev2147) +1 more potentially affected by CVE-2026-100842 via monai (0.7.0)

monai PYPI version 0.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on monai and may be impacted: - monailabel =0.2.0rc2, =0.3.0.dev2139, =0.1.0, =0.1.1 Source cves: CVE-2026-100842 Source advisory: OSV:PYSEC-2026-4017...

autorad (0.1.2), monailabel (0.3.0) +2 more potentially affected by CVE-2026-100842 via monai (0.8.0)

monai PYPI version 0.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on monai and may be impacted: - autorad 0.1.2 - monailabel 0.3.0 - monailabel-weekly =0.3.0.dev2150, =0.1.2, =0.1.4 Source cves: CVE-2026-100842 Source advisory: OSV:PYSEC-2026-4017...

deep-labelprop (1.1.1), fastmonai (>=0.1.0, <=0.1.4) +5 more potentially affected by CVE-2026-100844 via monai (0.8.1)

monai PYPI version 0.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on monai and may be impacted: - deep-labelprop 1.1.1 - fastmonai =0.1.0, =0.0.2, =0.0.3, =0.4.0.dev2201, =0.4.0.dev2208 Source cves: CVE-2026-100844 Source advisory: OSV:PYSEC-2026-4...

2404-segmentation-pipeline (>=0.1.0, <=1.0.0), abdomenatlas (>=0.1.0, <=0.1.1) +38 more potentially affected by CVE-2026-100842 via monai (>=1.0.0, <=1.6.0)

monai PYPI version =1.0.0, =0.1.0, =0.1.0, =0.0.1, =1.0.0rc1, =0.0.1, =0.1.5, =0.0.5, =0.1.5, =0.0.3, =6.0.0rc1, =0.1.1, =1.0.1a4, =1.0.1a5 and more Source cves: CVE-2026-100842 Source advisory: OSV:PYSEC-2026-4017...

2404-segmentation-pipeline (>=0.1.0, <=1.0.0), abdomenatlas (>=0.1.0, <=0.1.1) +38 more potentially affected by CVE-2026-100840 via monai (>=1.0.0, <=1.6.0)

monai PYPI version =1.0.0, =0.1.0, =0.1.0, =0.0.1, =1.0.0rc1, =0.0.1, =0.1.5, =0.0.5, =0.1.5, =0.0.3, =6.0.0rc1, =0.1.1, =1.0.1a4, =1.0.1a5 and more Source cves: CVE-2026-100840 Source advisory: OSV:PYSEC-2026-4015...

autorad (0.1.2), monailabel (0.3.0) +2 more potentially affected by CVE-2026-100840 via monai (0.8.0)

monai PYPI version 0.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on monai and may be impacted: - autorad 0.1.2 - monailabel 0.3.0 - monailabel-weekly =0.3.0.dev2150, =0.1.2, =0.1.4 Source cves: CVE-2026-100840 Source advisory: OSV:PYSEC-2026-4015...