CVE-2026-119578

Name of the Vulnerable Software and Affected Versions MONAI version 1.6.0

Description A remote code execution issue exists in the Auto3DSeg algo from json() function. An attacker can execute arbitrary Python code by providing a specially crafted algo object.json file within a work directory. This is achieved by supplying a malicious algorithm templates module and a specific target name, which are then imported and instantiated when the victim invokes AutoRunner or import bundle algo history using the default configuration.

Recommendations Update MONAI to version 1.6.1.