MONAI versions 1.2.0 through 1.6.1 contain a flaw that lets an attacker trigger arbitrary Python code during bundle loading. The vulnerability lies in ConfigWorkflow.__init__, which passes the bundle’s configs/logging.conf to logging.config.fileConfig; that function evals the handler class and args fields. If an attacker supplies a malicious bundle, the logging configuration is executed immediately when the victim constructs the workflow, resulting in full code execution within the process. The weakness is a classic code injection flaw with CWE‑94, and the impact is complete compromise of confidentiality, integrity, and availability.

The affected product is MONAI from Project‑MONAI. All deployments using MONAI 1.2.0 up to and including 1.6.1 are vulnerable, regardless of operating system or hosting environment. No specific platform scope is given; the issue applies to every install that can load third‑party bundles.

The flaw has a CVSS score of 8.6, indicating high severity. No EPSS score is reported, so the current exploitation probability cannot be quantified, but the existence of a remote code execution vector and the lack of mitigation on vulnerable builds suggests a significant risk. The vulnerability is not listed in the CISA KEV catalog, but that does not diminish the potential for abuse if attackers target installations that rely on user‑supplied bundles.