SZB-4bc9f2733f
CVE-2026-119578 reports remote code execution in MONAI Auto3DSeg
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- MONAI
- Product
- Auto3DSeg
- First seen
Summary
A CVE entry reported via TheHackerWire, with a CVSS score of 7.8, describes a remote code execution flaw in MONAI Auto3DSeg affecting versions 1.6.0 before 1.6.1. According to the item, attackers can run Python code through a crafted algo_object.json in a work directory.
If you use MONAI
Upgrade MONAI to version 1.6.1 or later
Do not load Auto3DSeg work directories from untrusted sources
Review algorithm templates in existing work directories for tampering
What the sources say 1
· Mastodon: “MONAI from 1.6.0 before 1.6.1 contains a remote code execution vulnerability in Auto3DSeg algo_from_json() that allows attackers to run Python code via a crafted work directory's algo_object.json.” Source