A bug in the MONAI bundle configuration engine allows an attacker to inject arbitrary callable references and Python expressions into a bundle. The engine performs dynamic importing and evaluates $ expressions using eval() without any allow list, meaning that data placed in the _target_ field of a bundle can trigger execution of code on the host. When a victim uses monai.bundle.load() or monai.bundle.run() to load a malicious bundle, the application will execute that code with the permissions of the running process, giving the attacker full control over the affected system.

The vulnerability affects all versions of MONAI up to and including 1.6.0. It is present in the Project‑MONAI MONAI library and any deployments that rely on these bundle loading functions.

The CVSS score of 8.5 classifies the issue as a high‑severity remote code execution flaw. No EPSS score is currently published, and it is not listed in the CISA KEV catalog. The recommended attack scenario is that an attacker publishes a malicious bundle that a victim downloads and loads locally or remotely via an insecure channel; the lack of an allow list and the use of eval() provide a straightforward exploitation path when the victim processes the bundle.