CVE-2026-118683 MONAI 1.2.0 before 1.6.1 Code Execution via bundle configs/logging.conf

High 8.6 Published 28 Oct 2026 Updated 29 Oct 2026

Exploited in the wild: Not known
Fix: None listed

What is CVE-2026-118683?

CVE-2026-118683 is a high-severity vulnerability in Project-MONAI MONAI, published on 28 Oct 2026.

Official description

MONAI from 1.2.0 before 1.6.1 contains a remote code execution vulnerability in ConfigWorkflow.__init__, which passes a bundle's configs/logging.conf to logging.config.fileConfig that eval()s handler class and args fields. Attackers can publish a malicious bundle whose logging.conf runs arbitrary Python at workflow construction when a victim loads or runs the bundle.

Weakness: CWE-94

Which versions are affected by CVE-2026-118683?

How do I fix CVE-2026-118683?

No fix has been published for CVE-2026-118683 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-118683 being exploited?

There is no known exploitation of CVE-2026-118683 in the wild and no public exploit code.

Sources

Also known as GHSA-475h-4rfw-9899, GHSA-wvpx-5qmp-46g3.