CVE-2026-119578

The record

MONAI from 1.6.0 before 1.6.1 contains a remote code execution vulnerability in Auto3DSeg algo_from_json() that allows attackers to run Python code via a crafted work directory's algo_object.json. Attackers can ship a malicious algorithm_templates module plus a _target_ name that is imported and instantiated when victims call AutoRunner or import_bundle_algo_history, executing code under default configuration.

Affected packages

Related vulnerabilities

• CVE-2026-108097 Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')… CWE-470
• CVE-2026-108099 Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')… CWE-470
• CVE-2026-119050 Agno through 3.1.11 contains an unsafe reflection vulnerability in PandasTools that… CWE-470
• CVE-2026-116692 MLflow is an open source AI engineering platform for agents, large language models, and… CWE-470
• CVE-2026-115931 Postiz lets a signed-in user ask the backend to run a function on one of their connected… CWE-470
• CVE-2026-115886 MLflow is an open source AI engineering platform for agents, large language models, and… CWE-470
• CVE-2026-115749 hydra-ray-launcher 1.1.0.dev1 before 1.2.2 and 1.4.0.dev4 before 1.4.0rc2 contains an… CWE-470
• CVE-2026-114660 Grav from 2.0.0 before 2.2.5 contains an improper access control vulnerability in… CWE-470