MONAI: Code injection via bundle configs/logging.conf
Summary
MONAI, a framework for medical imaging workflows, executes attacker-supplied Python code when a crafted bundle is loaded or run. The payload sits in the bundle's configs/logging.conf, which MONAI passes to logging.config.fileConfig, and that function evaluates handler fields with eval(). The attacker needs no account but must get a victim to load or run the malicious bundle, for example one from a public model repository. The code then runs with the privileges of the user running MONAI.
Affected
- MONAI from 1.2.0 before 1.6.1 (Project-MONAI and PyPI packages)
Fixed in
- Fixed in MONAI 1.6.1
Workaround
- No workaround is confirmed by the vendor. Upgrading to 1.6.1 is the only verified fix.
- Unverified: passing logging_file=False when loading untrusted bundles may skip the vulnerable code path. Test this before relying on it.
Exploitation
- No known exploitation in the wild. CISA SSVC lists exploitation as none.
- No public exploit code found in Metasploit or Exploit-DB at the time of research.
Our recommendation
- Upgrade MONAI to version 1.6.1 or later.
- Do not load bundles from untrusted sources until the upgrade is complete.
- Review configs/logging.conf in any bundle before use.
- Check the MONAI version in all Python environments, containers and CI pipelines.
- Run MONAI with least privilege and without access to clinical data where possible.
- Priority: medium if MONAI is in use, otherwise low.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-wvpx-5qmp-46g3 github.com
- VulnCheck advisory www.vulncheck.com
- VulDB CVE-2026-118683 vuldb.com
- MONAI 1.6.1 release notes github.com
- MONAI pull request 9114 github.com
- OffSeq Radar CVE-2026-118683 radar.offseq.com
- TheHackerWire CVE-2026-118683 www.thehackerwire.com
- Strix CVE-2026-118683 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 06:54.
Original description (NVD)
MONAI from 1.2.0 before 1.6.1 contains a remote code execution vulnerability in ConfigWorkflow.__init__, which passes a bundle's configs/logging.conf to logging.config.fileConfig that eval()s handler class and args fields. Attackers can publish a malicious bundle whose logging.conf runs arbitrary Python at workflow construction when a victim loads or runs the bundle.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.