{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/monai-1.6.0--1.6.1/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.8,"id":"CVE-2026-119578"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["MONAI 1.6.0 (\u003c 1.6.1)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eMONAI from 1.6.0 before 1.6.1 contains a remote code execution vulnerability in Auto3DSeg \u003ccode\u003ealgo_from_json()\u003c/code\u003e that allows attackers to run Python code via a crafted work directory's \u003ccode\u003ealgo_object.json\u003c/code\u003e. Attackers can ship a malicious \u003ccode\u003ealgorithm_templates\u003c/code\u003e module plus a \u003ccode\u003e_target_\u003c/code\u003e name that is imported and instantiated when victims call \u003ccode\u003eAutoRunner\u003c/code\u003e or \u003ccode\u003eimport_bundle_algo_history\u003c/code\u003e, executing code under default configuration.\u003c/p\u003e\n","date_modified":"2026-10-30T21:43:22Z","date_published":"2026-10-30T21:43:22Z","id":"https://feed.craftedsignal.io/briefs/2026-10-monai-rce-1f679264/","summary":"MONAI versions 1.6.0 before 1.6.1 contain a remote code execution vulnerability in Auto3DSeg's algo_from_json() function.","title":"MONAI: Remote Code Execution in Auto3DSeg (CVE-2026-119578)","url":"https://feed.craftedsignal.io/briefs/2026-10-monai-rce-1f679264/"}],"language":"en","title":"CraftedSignal Threat Feed - MONAI 1.6.0 (\u003c 1.6.1)","version":"https://jsonfeed.org/version/1.1"}