# CVE-2026-119578: MONAI Auto3DSeg remote code execution via algo_from_json

Source: https://junglewise.ai/threats/cve-2026-119578-monai-from-1-6-0-before-1-6-1-contains-a-remote-code-execution  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-30. Updated: 2026-10-30  
License: CC BY 4.0 with a link back

CVE-2026-119578 · Severity: high · CVSS 7.8 · Published 2026-10-30

MONAI is a medical imaging AI framework used to build and train deep learning models. A vulnerability in the Auto3DSeg module allows attackers to execute arbitrary Python code when a researcher or clinician loads a shared work directory (such as a benchmark or trained model bundle) through AutoRunner or import_bundle_algo_history. An attacker can create a malicious directory that runs code with the privileges of the victim user as soon as it is loaded, without requiring any user interaction beyond opening the bundle.

Technologies: [Project-MONAI MONAI](https://junglewise.ai/threats/technologies/project-monai-monai). Vendors: [Project-MONAI](https://junglewise.ai/threats/vendors/project-monai).

## Quick answers

**Is CVE-2026-119578 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-119578 being exploited in the wild.

**How severe is CVE-2026-119578?** High severity, with a CVSS score of 7.8, published 30 October 2026.

**Which products and versions are affected?** Project-MONAI MONAI 1.6.0 through 1.6.0rc1.

**Is there a fix for CVE-2026-119578?** Yes: fixed in 1.6.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-119578 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-119578?** Check whether you run Project-MONAI MONAI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 1.6.1

## Technical details

The algo_from_json() function in Auto3DSeg reads an untrusted algo_object.json file and directly instantiates the _target_ field via ConfigParser.instantiate(), which uses pydoc.locate to import and call the named Python class. The function also adds attacker-controlled directories (algorithm_templates and template_path) to sys.path before instantiation, allowing a malicious module to be imported and executed. This occurs during AutoRunner construction before any dataset validation, with no MONAI_ALLOW_PICKLE gating in the default configuration.

## Affected products

- Project MONAI MONAI 1.6.0 through 1.6.0rc1

## Timeline

- 2026-10-15: disclosed
- 2026-10-30: advisory

## References

- [https://github.com/Project-MONAI/MONAI/security/advisories/GHSA-2wx3-8x3w-r8qv](https://github.com/Project-MONAI/MONAI/security/advisories/GHSA-2wx3-8x3w-r8qv)
- [https://www.vulncheck.com/advisories/monai-1.6.0-before-1.6.1-code-execution-via-auto3dseg-algo-from-json](https://www.vulncheck.com/advisories/monai-1.6.0-before-1.6.1-code-execution-via-auto3dseg-algo-from-json)

## Related threats

- [MONAI check_hash insufficient integrity verification](https://junglewise.ai/threats/cve-2026-118684-monai-before-1-6-1-contains-an-insufficient-integrity)
- [MONAI ConfigWorkflow remote code execution in logging.conf](https://junglewise.ai/threats/cve-2026-118683-monai-from-1-2-0-before-1-6-1-contains-a-remote-code-execution)
- [MONAI nnUNetV2Runner insecure deserialization in postprocessing](https://junglewise.ai/threats/cve-2026-109361-monai-1-2-0-before-1-6-1-contains-an-insecure-deserialization)
- [MONAI remote code execution in SENet pretrained weight loading](https://junglewise.ai/threats/cve-2026-109360-monai-0-4-0-before-1-6-1-contains-a-remote-code-execution)
- [MONAI unsafe deserialization in algo_from_pickle](https://junglewise.ai/threats/cve-2026-100846-monai-before-1-5-2-contains-a-deserialization-of-untrusted-data)