CVE-2026-118683: MONAI RCE — HIGH

CISO Take

MONAI versions 1.2.0 up to 1.6.1 pass a bundle's configs/logging.conf to Python's logging.config.fileConfig, which eval()s handler class and args fields, so anyone who can get you to load a crafted bundle gets arbitrary Python execution at workflow construction. The CVSS is 8.8 (High) and the attack is low complexity with no privileges, but it requires the victim to load or run the bundle. There is no KEV listing, no public exploit, no Nuclei template and no EPSS score yet, so exploitation is not currently observed, though the trivial nature of eval-based injection means a proof of concept is easy to build. Medical imaging and research teams that routinely pull community or third-party bundles from model zoos are the most exposed. Upgrade MONAI to 1.6.1 or later, and until then only load bundles from sources you have verified and cryptographically pinned.

Sources:NVDGitHub AdvisoryVulnCheckATLAS

What is the risk?

High. CWE-94 code injection with full confidentiality, integrity and availability impact (C:H/I:H/A:H) and low attack complexity. The main limiter is required user interaction: the victim must load or run an attacker-supplied bundle. No public exploit, KEV listing or EPSS data is available at publication, so near-term exploitation likelihood is unquantified, but the technique is simple. Risk is elevated in environments where bundles are shared across teams or downloaded from public hubs, and where MONAI runs with access to PHI, GPUs, cloud credentials or training data.

How does the attack unfold?

Malicious bundle publication

Attacker publishes or shares a bundle whose configs/logging.conf contains a malicious handler class or args expression.

AML.T0058

User loads bundle

Victim downloads and runs the bundle, constructing ConfigWorkflow.

AML.T0011.000

Code execution

logging.config.fileConfig eval()s the payload during __init__, running arbitrary Python.

AML.T0050

Impact

Attacker steals data, model weights and credentials, or pivots within the ML environment.

AML.T0025

Malicious bundle publication

Attacker publishes or shares a bundle whose configs/logging.conf contains a malicious handler class or args expression.

AML.T0058

User loads bundle

Victim downloads and runs the bundle, constructing ConfigWorkflow.

AML.T0011.000

Code execution

logging.config.fileConfig eval()s the payload during __init__, running arbitrary Python.

AML.T0050

Impact

Attacker steals data, model weights and credentials, or pivots within the ML environment.

AML.T0025

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
MONAI	pip	—	No patch
8.8KOpenSSF 7.9128 dependentsPushed 7d ago41% patched~21d to patchFull package profile →

Do you use MONAI? You're affected.

How severe is it?

CVSS 3.1

8.8 / 10

EPSS

0.5%

chance of exploitation in 30 days

Higher than 42% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRNone

UIRequired

SUnchanged

CHigh

IHigh

AHigh

What should I do?

1 step

1) Upgrade MONAI to 1.6.1 or later. 2) Inventory where MONAI bundles are loaded (CI, notebooks, training clusters, inference services) and which bundle sources they use. 3) Until patched, load only bundles from trusted, integrity-verified sources, and inspect configs/logging.conf for non-standard handler class or args values containing callables, imports or eval-able expressions. 4) Run bundle loading in sandboxed containers with minimal privileges, no cloud credentials, and restricted egress. 5) Detect by monitoring for unexpected child processes, outbound connections or file writes from Python processes that load MONAI bundles. 6) Pin bundle versions by hash and review the GitHub advisory GHSA-wvpx-5qmp-46g3.

How is it classified?

Code ExecutionSupply ChainFrameworkModelAML.T0010.003- Model AML.T0011.000- Unsafe AI Artifacts AML.T0050- Command and Scripting Interpreter AML.T0058- Publish Poisoned Models

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.10.3-Suppliers

NIST AI RMF

GOVERN 6.1-Policies for third-party AI risks

OWASP LLM Top 10

LLM03-Supply Chain

Frequently Asked Questions

What is CVE-2026-118683?

MONAI versions 1.2.0 up to 1.6.1 pass a bundle's configs/logging.conf to Python's logging.config.fileConfig, which eval()s handler class and args fields, so anyone who can get you to load a crafted bundle gets arbitrary Python execution at workflow construction. The CVSS is 8.8 (High) and the attack is low complexity with no privileges, but it requires the victim to load or run the bundle. There is no KEV listing, no public exploit, no Nuclei template and no EPSS score yet, so exploitation is not currently observed, though the trivial nature of eval-based injection means a proof of concept is easy to build. Medical imaging and research teams that routinely pull community or third-party bundles from model zoos are the most exposed. Upgrade MONAI to 1.6.1 or later, and until then only load bundles from sources you have verified and cryptographically pinned.

Is CVE-2026-118683 actively exploited?

No confirmed active exploitation of CVE-2026-118683 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-118683?

1) Upgrade MONAI to 1.6.1 or later. 2) Inventory where MONAI bundles are loaded (CI, notebooks, training clusters, inference services) and which bundle sources they use. 3) Until patched, load only bundles from trusted, integrity-verified sources, and inspect configs/logging.conf for non-standard handler class or args values containing callables, imports or eval-able expressions. 4) Run bundle loading in sandboxed containers with minimal privileges, no cloud credentials, and restricted egress. 5) Detect by monitoring for unexpected child processes, outbound connections or file writes from Python processes that load MONAI bundles. 6) Pin bundle versions by hash and review the GitHub advisory GHSA-wvpx-5qmp-46g3.

What systems are affected by CVE-2026-118683?

This vulnerability affects the following AI/ML architecture patterns: training pipelines, model serving, medical imaging pipelines, model bundle distribution / model zoos, Jupyter-based ML workflows.

What is the CVSS score for CVE-2026-118683?

CVE-2026-118683 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 0.49%.

What is the AI security impact?

Affected AI Architectures

training pipelinesmodel servingmedical imaging pipelinesmodel bundle distribution / model zoosJupyter-based ML workflows

MITRE ATLAS Techniques

AML.T0010.003Model

AML.T0011.000Unsafe AI Artifacts

AML.T0050Command and Scripting Interpreter

AML.T0058Publish Poisoned Models

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.10.3

NIST AI RMF: GOVERN 6.1

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

MONAI from 1.2.0 before 1.6.1 contains a remote code execution vulnerability in ConfigWorkflow.__init__, which passes a bundle's configs/logging.conf to logging.config.fileConfig that eval()s handler class and args fields. Attackers can publish a malicious bundle whose logging.conf runs arbitrary Python at workflow construction when a victim loads or runs the bundle.

Exploitation Scenario

An attacker publishes a bundle that mimics a popular segmentation model to a public hub, or shares it through a collaboration channel, with a configs/logging.conf whose handler args field contains a malicious Python expression. A data scientist downloads the bundle and runs it with ConfigWorkflow. During __init__, fileConfig evaluates the payload, which runs a reverse shell or steals cloud credentials, SSH keys and patient imaging datasets from the GPU workstation before the model even loads.

Weaknesses (CWE)

CWE-94Improper Control of Generation of Code ('Code Injection')Primary CWE-94Improper Control of Generation of Code ('Code Injection')

CWE-94 — Improper Control of Generation of Code ('Code Injection'): The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

[Architecture and Design] Refactor your program so that you do not have to dynamically generate code.
[Architecture and Design] Run your code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which code can be executed by your product. Examples include the Unix chroot jail and AppArmor. In general, managed code may provide some protection. This may not be a feasible solution, and it only limits the impact to the operating system; the rest of your application may still be subject to compromise. Be careful to avoid CWE-243 and other weaknesses related to jails.

Source: MITRE CWE corpus.