CVE-2026-119578: MONAI 1.6.0 before 1.6.1 Code Execution via Auto3DSeg algo_from_json()

Published Oct 30, 2026

Updated

MONAI from 1.6.0 before 1.6.1 contains a remote code execution vulnerability in Auto3DSeg algofromjson() that allows attackers to run Python code via a crafted work directory's algoobject.json. Attackers can ship a malicious algorithmtemplates module plus a target name that is imported and instantiated when victims call AutoRunner or importbundlealgohistory, executing code under default configuration.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade MONAI to a version that resolves this vulnerability.
Fixed in 1.6.1

Event History

Oct 30, 2026

CVE Published

via MITRE·01:18 PM

Data Sourced

via MITRE·01:18 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·02:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Users of MONAI 1.6.0 who process a crafted work directory through Auto3DSeg are exposed. The affected paths are calling AutoRunner or import_bundle_algo_history on data that includes a malicious algo_object.json and algorithm_templates module.

What does an attacker need to exploit it?

The attacker needs to provide or cause a victim to use a crafted work directory containing algo_object.json and a malicious algorithm_templates module. The JSON supplies a _target_ name that is imported and instantiated by the affected code path.

Is a non-default configuration required?

No. The vulnerable import and instantiation behavior occurs under the default configuration when the victim calls AutoRunner or import_bundle_algo_history.

What is the immediate mitigation if upgrading is not possible?

Do not run AutoRunner or import_bundle_algo_history against untrusted work directories. Only use work directories whose algo_object.json and algorithm_templates contents are trusted.

CVE-2026-119578: MONAI 1.6.0 before 1.6.1 Code Execution via Auto3DSeg algo_from_json()

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

Is a non-default configuration required?

What is the immediate mitigation if upgrading is not possible?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

Is a non-default configuration required?

What is the immediate mitigation if upgrading is not possible?