CVE-2026-119578 in MONAI
Summary
by MITRE • 10/30/2026
MONAI from 1.6.0 before 1.6.1 contains a remote code execution vulnerability in Auto3DSeg algo_from_json() that allows attackers to run Python code via a crafted work directory's algo_object.json. Attackers can ship a malicious algorithm_templates module plus a _target_ name that is imported and instantiated when victims call AutoRunner or import_bundle_algo_history, executing code under default configuration.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/30/2026
The MONAI library version 1.6.0 through versions prior to 1.6.1 contains a critical remote code execution vulnerability within the Auto3DSeg module's algo_from_json function. This flaw arises from an insecure deserialization mechanism that allows attackers to execute arbitrary Python code by manipulating configuration files associated with automated segmentation algorithms. The vulnerability specifically targets the algorithm loading process, where the system attempts to dynamically import and instantiate classes based on JSON configurations provided in a work directory. By crafting a malicious algo_object.json file containing a specially designed target field, an attacker can force the application to load arbitrary modules from the filesystem or network locations under default configuration settings.
The technical root cause of this vulnerability lies in how the AutoRunner and import_bundle_algo_history functions process algorithm definitions. When these functions are invoked, they parse JSON files that specify which Python classes should be instantiated for specific segmentation tasks. The flaw permits an attacker to supply a target value that references a malicious module or class path rather than a legitimate MONAI component. Upon execution, the application imports this specified module and instantiates the target class without sufficient validation of its origin or content. This dynamic import mechanism effectively bypasses standard security controls because it trusts user-supplied configuration data as executable code paths, leading to arbitrary command execution on the host system running the vulnerable software.
From an operational perspective, this vulnerability poses a severe risk in environments where MONAI is used for automated medical image analysis pipelines that accept external or untrusted algorithm configurations. An attacker who can influence the contents of the work directory's algo_object.json file, either through direct access to shared storage, compromised CI/CD artifacts, or malicious model bundles distributed via community channels, can achieve full remote code execution with the privileges of the user running the MONAI application. This could lead to complete system compromise, data exfiltration, lateral movement within internal networks, and disruption of critical healthcare research workflows that rely on automated segmentation tools for diagnosis and treatment planning.
This vulnerability aligns closely with CWE-502 Deserialization of Untrusted Data, as it involves the unsafe processing of externally supplied configuration structures that result in arbitrary code execution. It also maps to MITRE ATT&CK technique T1059 Command and Scripting Interpreter, specifically Python subcategory, where attackers leverage scripting languages to execute commands on compromised systems. The attack vector is classified under CWE-78 Improper Neutralization of Special Elements used in an OS Command for similar outcomes via configuration manipulation.
To mitigate this vulnerability, organizations must immediately upgrade MONAI to version 1.6.1 or later, which addresses the insecure deserialization logic by implementing stricter validation and sandboxing mechanisms for algorithm loading processes. In environments where upgrading is not immediately feasible, administrators should restrict file system permissions on work directories containing algo_object.json files to prevent unauthorized modification. Additionally, input validation strategies should be employed to whitelist allowed module paths and class names rather than relying solely on dynamic imports from user-supplied JSON structures. Security teams should also audit existing pipelines for any reliance on untrusted algorithm bundles and implement code signing or integrity verification mechanisms for all configuration artifacts before they are processed by AutoRunner functions.