The vulnerability arises from the Auto3DSeg algo_from_json() function in MONAI 1.6.0 and earlier. A crafted algorithm object JSON in a tampered work directory can import and instantiate a malicious Python module, allowing arbitrary code execution under the application’s user account. This vulnerability falls under CWE-470, indicating execution of code from an untrusted source. Successful exploitation results in full control of the host system running the MONAI instance.

MONAI from Project MONAI, version 1.6.0 through any release before 1.6.1. The vulnerability exists in the auto3dseg component that processes algo_object.json files in the work directory.

The CVSS score of 8.5 indicates a high‑severity condition. No EPSS data is available, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that attackers would need write access to the work directory or the ability to supply a custom JSON file, and must then run MONAI components that invoke AutoRunner or import_bundle_algo_history. Based on the description, it is inferred that the vulnerability can be exploited remotely by supplying a malicious file from a networked source or through local file injection on a system with an attacker’s write privileges.