CVE-2026-119578 MONAI 1.6.0 before 1.6.1 Code Execution via Auto3DSeg algo_from_json()
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-119578?
CVE-2026-119578 is a high-severity vulnerability in Project-MONAI MONAI, published on 30 Oct 2026.
Official description
MONAI from 1.6.0 before 1.6.1 contains a remote code execution vulnerability in Auto3DSeg algo_from_json() that allows attackers to run Python code via a crafted work directory's algo_object.json. Attackers can ship a malicious algorithm_templates module plus a _target_ name that is imported and instantiated when victims call AutoRunner or import_bundle_algo_history, executing code under default configuration.
Weakness: CWE-470
Which versions are affected by CVE-2026-119578?
How do I fix CVE-2026-119578?
No fix has been published for CVE-2026-119578 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-119578 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-119578 exists.
Sources
Also known as GHSA-2wx3-8x3w-r8qv, GHSA-rx25-w8hq-hr3g.