{"id":"CVE-2026-118683","kind":"vulnerability","aliases":["CVE-2026-118683"],"related":[],"title":"MONAI: malicious bundle's logging config runs arbitrary Python on load","description":"MONAI from 1.2.0 before 1.6.1 contains a remote code execution vulnerability in ConfigWorkflow.__init__, which passes a bundle's configs/logging.conf to logging.config.fileConfig that eval()s handler class and args fields. Attackers can publish a malicious bundle whose logging.conf runs arbitrary Python at workflow construction when a victim loads or runs the bundle.","summary":"MONAI versions 1.2.0 through 1.6.0 pass a bundle's configs/logging.conf to Python's logging.config.fileConfig, which evaluates handler class and argument fields as code. An attacker who publishes a malicious bundle gets arbitrary Python execution on the machine of anyone who loads or runs it.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["medical-imaging","ml-pipelines","monai","package","python"],"not_affected_if":["default-config"],"how_to_check":"- Check the installed MONAI version with `python -c \"import monai; print(monai.__version__)\"`; versions below `1.6.1` are in range.\n- Inspect any third-party bundle's `configs/logging.conf` for unexpected `eval`-style handler or args values.","fix":"- Upgrade MONAI to `1.6.1` or later.\n- Only load bundles from trusted sources until upgraded.","status":"open","published_at":"2026-10-28T19:17:35+00:00","first_seen_at":"2026-10-28T19:34:55+00:00","triaged_at":"2026-10-28T19:35:42+00:00","updated_at":"2026-10-28T19:35:42+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-28T19:35:42Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade MONAI to `1.6.1` or later.\n- Only load bundles from trusted sources until upgraded.","reach":"local","title":"MONAI: malicious bundle's logging config runs arbitrary Python on load","impact":"high","summary":"MONAI versions 1.2.0 through 1.6.0 pass a bundle's configs/logging.conf to Python's logging.config.fileConfig, which evaluates handler class and argument fields as code. An attacker who publishes a malicious bundle gets arbitrary Python execution on the machine of anyone who loads or runs it.","category":"package","nicknames":[],"who_cares":["python","monai","medical-imaging","ml-pipelines"],"confidence":0.7,"needs_auth":"no","worst_case":"Arbitrary Python code runs on the victim's machine during bundle load","analyst_note":"Sources list only the NVD entry; confirm the fixed version and whether a public bundle hub is a common delivery path.","how_to_check":"- Check the installed MONAI version with `python -c \"import monai; print(monai.__version__)\"`; versions below `1.6.1` are in range.\n- Inspect any third-party bundle's `configs/logging.conf` for unexpected `eval`-style handler or args values.","needs_analyst":true,"not_affected_if":["default-config"],"who_is_affected":"Teams that load MONAI bundles, especially ones downloaded from public model hubs or shared by outside parties, since the bundle's logging.conf is executed when ConfigWorkflow is constructed. Systems that only use bundles they authored or vetted, or that run no MONAI bundle workflows, are less exposed.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000642,"input_tokens":3367,"output_tokens":610,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-118683':14A,17A '-2026':13A,16A '1.2.0':29B,72C '1.6.0':31B '1.6.1':74C 'anyon':65B 'arbitrari':8A,58B,108C 'arg':97C 'argument':46B 'attack':51B,99C 'bundl':3A,34B,56B,86C,104C,120C 'class':44B,95C 'code':49B,78C 'config':6A 'configs/logging.conf':36B,88C 'configworkflow.__init__':82C 'construct':112C 'contain':75C 'cve':12A,15A 'eval':92C 'evalu':42B 'execut':60B,79C 'field':47B,98C 'get':57B 'handler':43B,94C 'imag':20B 'load':11A,67B,116C 'log':5A 'logging.conf':106C 'logging.config.fileconfig':40B,90C 'machin':63B 'malici':2A,55B,103C 'medic':19B 'medical-imag':18B 'ml':22B 'ml-pipelin':21B 'monai':1A,24B,27B,70C 'packag':25B 'pass':32B,84C 'pipelin':23B 'publish':53B,101C 'python':9A,26B,38B,59B,109C 'remot':77C 'run':7A,69B,107C,118C 'version':28B 'victim':115C 'vulner':80C 'whose':105C 'workflow':111C","nicknames":[],"mitigations":[],"who_affected":"Teams that load MONAI bundles, especially ones downloaded from public model hubs or shared by outside parties, since the bundle's logging.conf is executed when ConfigWorkflow is constructed. Systems that only use bundles they authored or vetted, or that run no MONAI bundle workflows, are less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T19:17:35+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118683","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118683","severity":null,"published_at":"2026-10-28T19:17:35+00:00","modified_at":"2026-10-28T19:17:35+00:00","first_seen_at":"2026-10-28T19:34:55+00:00","fetched_at":"2026-10-28T19:34:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}