CVE-2026-100842 in MONAI
Summary
by MITRE • 09/27/2026
MONAI through 1.6.0 contains an eval injection vulnerability in _get_fake_spatial_shape() in monai/bundle/scripts.py. The function validates shape expressions with a helper that walks the AST and only collects ast.Name nodes, rejecting any name other than 'p' or 'n', before passing the string to eval(). Expressions built solely from constants and attribute, subscript, or call nodes (for example "(1).__class__.__bases__[0].__subclasses__()" or "int.__class__.__init__.__globals__") contain no ast.Name nodes and therefore bypass the allowlist. Because the shape value originates from bundle metadata consumed by _get_real_input_data and verify_net_in_out (reachable through the bundle 'verify_net_in_out' CLI flow), an attacker who can influence a bundle's metadata can escape the eval sandbox via object introspection chains and achieve code execution in this non-default flow.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/27/2026
The vulnerability identified in MONAI versions up to 1.6.0 represents a critical insecure evaluation of user-supplied input, specifically within the _get_fake_spatial_shape function located in monai/bundle/scripts.py. This flaw stems from an inadequate implementation of a security sandbox designed to restrict code execution during shape validation processes. The intended defense mechanism involves parsing Python expressions into Abstract Syntax Trees and filtering them against a strict allowlist that permits only specific variable names, namely 'p' and 'n'. However, the logic governing this filter is fundamentally flawed because it relies exclusively on the presence of ast.Name nodes to determine safety. This approach fails to account for alternative methods of code execution that do not require named variables, thereby creating a significant bypass vector for attackers capable of manipulating bundle metadata.
The technical core of the vulnerability lies in how Python's eval function interacts with object introspection capabilities when no variable names are present in the expression string. The validation logic incorrectly assumes that any expression lacking ast.Name nodes is safe because it cannot reference external variables or state. In reality, Python objects such as integers and classes possess extensive internal structures accessible through attributes like _class_, _bases_, and _subclasses_. An attacker can construct malicious payloads using only constants and attribute access chains to traverse these object hierarchies. For instance, an expression starting with a literal integer can navigate up the class hierarchy to reach built-in types or modules, eventually accessing functions that allow arbitrary code execution without ever referencing a named variable. This effectively neutralizes the intended sandbox restrictions by exploiting the rich introspection features inherent in Python's dynamic type system.
From an operational perspective, this vulnerability poses severe risks due its accessibility through standard bundle verification workflows. The affected function is invoked during the processing of MONAI bundles, particularly when executing the verify_net_in_out command-line interface flow or related data validation routines. Since these operations are often part of automated pipelines for model deployment and testing, they may run with elevated privileges or within environments where code execution can lead to broader system compromise. An adversary who gains control over a bundle's metadata file, which is commonly shared between developers and operators, can inject malicious shape definitions that trigger the eval injection upon verification. This allows for remote code execution without requiring direct access to the underlying application source code or complex exploitation techniques beyond crafting specific Python expressions.
This vulnerability aligns with CWE-94 Improper Control of Generation of Code (Code Injection) as it involves the construction and execution of dynamic code from untrusted input in a manner that bypasses security controls. Furthermore, it maps to MITRE ATT&CK technique T1059 Command and Scripting Interpreter under subtechnique Python, specifically illustrating how attackers can abuse scripting language features for arbitrary command execution. The exploitation path also reflects CWE-20 Improper Input Validation because the sanitization logic fails to adequately restrict the scope of allowed operations based on structural analysis rather than just lexical token filtering.
Mitigation strategies must prioritize immediate updates to MONAI versions greater than 1.6.0 where this issue has been addressed by developers through more robust parsing and execution restrictions. In environments where upgrading is not immediately feasible, organizations should implement strict input validation at the bundle ingestion layer, rejecting any metadata containing complex object attribute chains or calls that do not adhere to a whitelist of allowed function signatures rather than just variable names. Additionally, running bundle verification processes in isolated containers with restricted permissions can limit the impact if an injection attempt succeeds. Security teams should also audit existing bundles for suspicious patterns involving double underscores and class traversal sequences before processing them through vulnerable versions of the framework.