MONAI from 1.6.0 before 1.6.1 contains a remote code execution vulnerability in Auto3DSeg algo_from_json() that allows attackers to run Python code via a crafted work directory's algo_object.json. Attackers can ship a malicious algorithm_templates module plus a _target_ name that is imported and instantiated when victims call AutoRunner or import_bundle_algo_history, executing code under default configuration.
Fix
STIG rules that mitigate this class
With AutoPlay off, inserting removable media does not run what is on it. DISA STIG rule discussion (the rule's own text, quoted on the rule page) (the owner's mapping, data/mitigations.yaml: autorun)
- WN11-CC-000190 CAT I Autoplay must be disabled for all drives. Microsoft Windows 11
- WN22-CC-000230 CAT I Windows Server 2022 AutoPlay must be disabled for all drives. Microsoft Windows Server 2022
- WN25-CC-000230 CAT I Windows Server 2025 AutoPlay must be disabled for all drives. Microsoft Windows Server 2025
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 8.5 · project-monaiNVD modified 2026-10-30 14:04
Affected (CPE criteria) 0
NVD has not attached CPE configurations yet.