Advisory · CVE-2026-118683
Remote code execution via malicious MONAI bundle logging configuration
A malicious MONAI bundle can run arbitrary Python when a victim loads or runs it, because bundle logging configuration is evaluated. Rated 8.8.
- Vendor
- Project MONAI
- Product
- MONAI
- Identifier / CWE
- CVE-2026-118683
CWE-94 - Action timing
- Immediate
Explain it like I’m five
A bundle is supposed to carry settings, but its logging file is treated as instructions. A booby-trapped bundle runs its own code the moment someone opens it.
- 01Malicious bundle
An attacker publishes a malicious bundle whose logging.conf carries crafted handler class and argument fields.
- 02Bundle loaded
A victim loads or runs the bundle.
- 03Configuration evaluated
ConfigWorkflow passes the bundle configs to logging configuration handling that evaluates the fields.
- 04Arbitrary Python runs
The attacker's code executes at workflow construction.
What happened
MONAI from 1.2.0 before 1.6.1 contains a remote code execution vulnerability in ConfigWorkflow, which passes a bundle’s configs and logging.conf to logging configuration handling that evaluates handler class and argument fields. Attackers can publish a malicious bundle whose logging.conf runs arbitrary Python at workflow construction when a victim loads or runs the bundle. The CVSS 3.1 score is 8.8.
The trigger is loading an untrusted bundle, so the risk concentrates on teams pulling community or third-party bundles into research or clinical pipelines rather than on self-authored bundles alone.
What to do
- Inventory MONAI deployments and bundle sources.
- Upgrade to MONAI 1.6.1 or later.
- Load bundles only from trusted sources until patched.
- Review recently loaded bundles for suspicious logging configuration.
- Confirm the deployed version after patching.
Management note
Bundles are executable content in practice, even when they look like configuration. Treat untrusted medical-imaging bundles like untrusted code, because that is what they are.