Eval Injection Vulnerability in MONAI by Project MONAI
CVE-2026-100842

7.3HIGH

Key Information:

Vendor

Project-monai

Status
Monai
Vendor
CVE Published:
27 September 2026

What is CVE-2026-100842?

The eval injection vulnerability in MONAI allows an attacker to exploit a flaw in the _get_fake_spatial_shape() function, where validation of shape expressions fails. The function collects only certain nodes (ast.Name) while ignoring others, thus enabling an attacker to craft expressions using constants and bypass the allowlist. This vulnerability occurs when an attacker influences the bundle's metadata consumed during the execution of specific CLI flows, leading to potential unauthorized code execution.

Affected Version(s)

MONAI 0 <= 1.6.0

References

https://github.com/Project-MONAI/MONAI/security/advisorie...
vendor-advisory
https://www.vulncheck.com/advisories/monai-through-1.6.0-...
third-party-advisory

CVSS V4

Score:
7.3
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.