CVE-2026-100842: MONAI through 1.6.0 _get_fake_spatial_shape eval() Sandbox Bypass via Attribute Chains
MONAI through 1.6.0 contains an eval injection vulnerability in getfakespatialshape() in monai/bundle/scripts.py. The function validates shape expressions with a helper that walks the AST and only collects ast.Name nodes, rejecting any name other than 'p' or 'n', before passing the string to eval(). Expressions built solely from constants and attribute, subscript, or call nodes (for example "(1).class.bases[0].subclasses()" or "int.class.init.globals") contain no ast.Name nodes and therefore bypass the allowlist. Because the shape value originates from bundle metadata consumed by getrealinputdata and verifynetinout (reachable through the bundle 'verifynetinout' CLI flow), an attacker who can influence a bundle's metadata can escape the eval sandbox via object introspection chains and achieve code execution in this non-default flow.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of MONAI through 1.6.0 are exposed when they run the bundle verify_net_in_out CLI flow on bundle metadata that an attacker can influence. The affected path is non-default.
What does an attacker need to exploit it?
An attacker needs the ability to influence shape expressions in bundle metadata that is consumed by _get_real_input_data and verify_net_in_out. They do not need to rely on allowed variable names because attribute, subscript, and call chains can bypass the AST name allowlist.
What is the impact of successful exploitation?
Successful exploitation can escape the eval sandbox through Python object-introspection chains and achieve code execution.
How can teams reduce risk before patching?
Do not run verify_net_in_out against untrusted or externally supplied bundle metadata. Restrict who can create or modify bundle metadata used by this CLI flow.