Remote Code Execution in MONAI Software by Project MONAI
CVE-2026-118683

8.6HIGH

Key Information:

Vendor

Project-monai

Status
Monai
Vendor
CVE Published:
28 October 2026

What is CVE-2026-118683?

A remote code execution vulnerability exists in MONAI versions prior to 1.6.1, specifically within the ConfigWorkflow.init function. This flaw allows attackers to define a malicious bundle that includes a specially crafted logging configuration file (logging.conf). When a victim loads or runs this compromised bundle, the eval() function might execute arbitrary Python code, potentially compromising the integrity of the system.

Affected Version(s)

MONAI 1.2.0 < 1.6.1

MONAI 1.6.1

References

https://github.com/Project-MONAI/MONAI/security/advisorie...
vendor-advisory
https://www.vulncheck.com/advisories/monai-1.2.0-before-1...
third-party-advisory

CVSS V4

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

ttzero25
.