CVE-2026-119578

MONAI Auto3DSeg imports code from untrusted algorithm work directories

Project MONAI · MONAI Auto3DSeg algo_from_json

First documented disclosure · Review checkpoint

Summary

Loading an untrusted algorithm work directory can execute Python during construction.

Severity and exploitation evidence

High · 8.5/10 · CVSS 4.0. Severity source.

Exploitation not established: The original advisory demonstrates controlled code execution from a crafted work directory. No reviewed source establishes malicious exploitation or confirmed victims.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

algo_object.json controls a target class and template paths added to Python's import search path; the loader imports and instantiates the target.

Conditions required

A user loads an attacker-supplied work directory with AutoRunner or import_bundle_algo_history. The demonstrated JSON path does not require MONAI_ALLOW_PICKLE.

Potential impact

Code execution with the workload user's filesystem and credential access.

Affected versions and configurations

CNA: >=1.6.0 and <1.6.1. The original GHSA instead lists <=1.6.0rc1; its range metadata differs.

Fix and mitigation status

1.6.1 is vendor-listed and restricts targets to Algo subclasses, but the patch explicitly retains unsafe module-import risk for untrusted template directories.

Practical next steps

Use a supported patched release and load only trusted algorithm bundles in an isolated environment. Do not treat the subclass restriction as a safe loader for attacker-controlled modules. Track the later literal-state fix separately.

Operating lesson

Type-checking a class after importing its module does not make the import safe.

Evidence and limits

September 3 PR 9085 disclosed the exact sink and added a warning. September 11 PR 9115, merged September 17, narrows targets but explicitly says importing still executes top-level code. The October 15 GHSA and October 30 CNA list 1.6.1 as fixed; that does not erase this limitation. October 29 PR 9233 separately makes saved-state strings literal; no fixed release for that later change is inferred. CVSS 4.0 8.5 is the CNA assessment, versus 7.8 CVSS 3.1.

Sources