The vulnerability arises in MONAI’s _get_fake_spatial_shape function, where user‑supplied shape expressions are improperly validated before being passed to eval(). The validator accepts only ast.Name nodes that equal 'p' or 'n', rejecting other identifiers, but it ignores expressions that do not contain any ast.Name nodes. By constructing expressions that rely solely on constants and chained attribute, subscript, or call nodes—such as (1).__class__.__bases__[0].__subclasses__() or int.__class__.__init__.__globals__—an attacker can bypass the whitelist and execute arbitrary Python code after eval() runs. The injected code runs with the privileges of the process that loads the bundle, allowing full code‑execution control in an otherwise restricted environment.

The flaw affects Project‑MONAI’s MONAI library versions up to and including 1.6.0. These releases are identified by the vendor product MONAI and are referenced by the CPE cpe:2.3:a:project-monai:monai:*:*:*:*:*:*:*.*. Users who employ these versions and process bundles that include user‑controlled metadata through the verify_net_in_out command line flow are vulnerable. No other sub‑components or third‑party packages are reported to be affected.

The CVSS score of 7.3 indicates a medium‑to‑high severity. EPSS is not available and the vulnerability is not listed in CISA’s KEV catalog, suggesting no widespread, publicly known exploitation at the time of the advisory. Exploitation requires the attacker to supply or modify bundle metadata consumed by the non‑default verify_net_in_out flow, which is typically a local or privileged action. Therefore, the risk is significant for deployments that allow untrusted bundle metadata or that run the CLI flow without strict input validation.