CVE-2026-100842 MONAI through 1.6.0 _get_fake_spatial_shape eval() Sandbox Bypass via Attribute Chains

High 7.3 Published 27 Sep 2026 Updated 30 Sep 2026

Attacker can execute arbitrary code via eval injection in MONAI bundle verification if they control bundle metadata.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2026-100842?

CVE-2026-100842 is a high-severity code injection vulnerability in Project-MONAI MONAI, published on 27 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

MONAI through 1.6.0 contains an eval injection vulnerability in _get_fake_spatial_shape() in monai/bundle/scripts.py. The function validates shape expressions with a helper that walks the AST and only collects ast.Name nodes, rejecting any name other than 'p' or 'n', before passing the string to eval(). Expressions built solely from constants and attribute, subscript, or call nodes (for example "(1).__class__.__bases__[0].__subclasses__()" or "int.__class__.__init__.__globals__") contain no ast.Name nodes and therefore bypass the allowlist. Because the shape value originates from bundle metadata consumed by _get_real_input_data and verify_net_in_out (reachable through the bundle 'verify_net_in_out' CLI flow), an attacker who can influence a bundle's metadata can escape the eval sandbox via object introspection chains and achieve code execution in this non-default flow.

Weakness: CWE-95

Which versions are affected by CVE-2026-100842?

1 open source package ship an affected version, including monai. It affects 1 product.

Package	Affected	Fixed in
`monai` PyPI	All versions	`1.6.1rc0`

Products include Project-Monai Monai.

How do I fix CVE-2026-100842?

Upgrade monai to 1.6.1rc0 or later.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2026-100842 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-100842 exists.

Sources

Also known as GHSA-h89g-r5pc-wxfm, GHSA-j335-cfj5-2fw8, PYSEC-2026-4017.