SZB-d3c76dacb7
MONAI remote code execution flaw in Auto3DSeg reported (EUVD-2026-113932)
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- Project-MONAI
- Product
- MONAI
- First seen
Summary
The EU Vulnerability Database (EUVD) lists a remote code execution vulnerability in MONAI from 1.6.0 before 1.6.1, scored 8.5/10 (CVSS v3.1). According to the entry, attackers can run Python code by shipping a malicious algorithm_templates module with a crafted algo_object.json.
If you use Project-MONAI
Upgrade MONAI to 1.6.1 or later
Only load Auto3DSeg work directories from trusted sources
Inspect work directories for unexpected algorithm_templates modules
What the sources say 1
· Mastodon: “MONAI from 1.6.0 before 1.6.1 contains a remote code execution vulnerability in Auto3DSeg algo_from_json() that allows attackers to run Python code via a crafted work directory's algo_object.json.” Source