MONAI from 1.6.0 before 1.6.1 contains a remote code execution vulnerability in Auto3DSeg algo_from_json() that allows attackers to run Python code…
MONAI from 1.6.0 before 1.6.1 contains a remote code execution vulnerability in Auto3DSeg algo_from_json() that allows attackers to run Python code via a crafted work directory's algo_object.json. Attackers can ship a malicious algorithm_templates module plus a _target_ name that is imported and instantiated when victims call AutoRunner or import_bundle_algo_history, executing code under default configuration.
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- Project-MONAI
- Product
- MONAI
- CVSS v3.1
- 7.8 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- EPSS
- 0.006 (p46)
- Exploitation
- SSVC poc, automatable no, impact total
- Weakness
- CWE-470
- NVD status
- Deferred
Why it ranks 31 (Notable)
- Public exploit code reported
- CVSS v3.1 7.8 high
- SSVC: total technical impact
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.