CVE-2026-118683

MONAI bundle logging configuration executes Python during workflow construction

Project MONAI · MONAI ConfigWorkflow bundle loader

First documented disclosure · Review checkpoint

Summary

An untrusted bundle can execute Python through its logging configuration before its workflow runs.

Severity and exploitation evidence

High · 8.6/10 · CVSS 4.0. Severity source.

Exploitation not established: The original advisory demonstrates controlled marker-file execution using a preplaced local bundle; the test skipped network download. Reviewed sources do not establish malicious exploitation or victims.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

ConfigWorkflow applies bundle configs/logging.conf through logging.config.fileConfig, which evaluates handler class and argument fields at construction time.

Conditions required

The attacker supplies a malicious bundle and the user loads or runs it with an affected MONAI installation; this is not an unauthenticated attack on every MONAI service.

Potential impact

Code runs with the loading process privileges, potentially exposing or changing local data and disrupting the workload.

Affected versions and configurations

MONAI >=1.2.0 and <1.6.1, according to the CNA; the original GHSA version fields are less precise.

Fix and mitigation status

1.6.1, released September 27. The complete fix screens logging classes and argument syntax before fileConfig; the earlier warning-only precursor is insufficient for ConfigWorkflow.

Practical next steps

Upgrade to a supported release containing the 1.6.1 fix, review bundle provenance and isolate untrusted bundles. Do not treat a warning or explicit logging-file opt-in as protection against this code-evaluation path.

Operating lesson

Treat logging configuration shipped inside a model bundle as executable supply-chain input.

Evidence and limits

Public PR 9078 described this exact GHSA and construction-time logging evaluation on August 28. It added warnings for ConfigWorkflow and disabled implicit logging in the FL path, but an explicit logging path still opted back in. PR 9114 opened September 11 and merged September 17, restricting logging class namespaces and argument syntax. The September 27 release precedes the October 13 GHSA and October 28 CNA ingestion. CNA CVSS 3.1 is 8.8 alongside the displayed CVSS 4.0 score. This logging sink is distinct from MONAI bundle-expression and optional-download-hash findings.

Sources