CVE-2024-42845

What it actually does

Eval injection in invesalius/reader/dicom.py permits arbitrary code execution when a crafted DICOM file is loaded, as untrusted input reaches an eval call without sanitization.

Why it matters to the business

Attackers can run malicious code on workstations that open medical imaging files, risking data theft, system compromise, and disruption of clinical workflows; the flaw affects widely used open-source software with no KEV or ransomware usage observed.

How an attack unfolds

An attacker crafts a DICOM file containing Python code in a field that reaches eval in dicom.py; the victim opens the file in InVesalius 3.1.99991-3.1.99998, triggering immediate code execution under the user's privileges.

How to fix it

Upgrade InVesalius to a version beyond 3.1.99998 that removes or secures the eval usage in dicom.py; avoid opening untrusted DICOM files until patched.

How to confirm the fix worked

Confirm the installed InVesalius version is newer than 3.1.99998 and test that crafted DICOM files no longer trigger code execution; review source for removal of direct eval on DICOM metadata.

Typical attack path

1. Attacker creates malicious DICOM file embedding executable Python payload
2. Payload is delivered via email, USB, or network share
3. Victim loads the file in the vulnerable InVesalius version
4. dicom.py executes the injected code via eval
5. Attacker gains code execution on the target system

How to detect it

Inspect file-access logs and process creation events for InVesalius loading DICOM files from unusual locations; look for unexpected Python subprocesses or network connections immediately after DICOM handling.

What your security team should do

• Block opening of DICOM files from untrusted sources until patched
• Monitor for InVesalius updates and deploy as soon as available
• Scan endpoints for presence of InVesalius versions 3.1.99991 through 3.1.99998