MONAI CVE-2026-118684

The flaw is reachable through MONAI's default download paths - _download_from_github, _download_from_monaihosting, _download_from_ngc, and the MedNIST/Decathlon dataset and MMAR/auto3dseg template downloads - all of which invoke check_hash with hash_val=None, so no integrity verification occurs on default bundle/dataset/model downloads before version 1.6.1. The required precondition is an attacker who can tamper with the download in transit (man-in-the-middle on a hop to the hosting URL) OR who controls/compromises a registry, CDN, or release channel (NGC, GitHub releases, MONAI hosting); alternatively, when a hash IS supplied, the MD5 default is collision-attackable by an attacker with the resources to compute a colliding payload. Limiting factors: exploitation is not possible against a passive attacker with no network/registry position (hence AT:P), direct impact is confined to integrity (malicious file delivery), and full code execution additionally depends on the downstream bundle-handling behaviour described as F001/F002. The only complete fix stated by the vendor is upgrading to MONAI 1.6.1 (which makes hash_val required and changes the default to SHA-256).

Signals are moderate and partly conflicting, so this is a real but conditional priority rather than a drop-everything emergency. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) scores 8.2 and models VI:H with VC:N/VA:N - i.e. the direct impact is integrity-only (malicious file substitution), not confidentiality or availability; the AT:P (attack requirement) captures that the attacker must hold a privileged network position or control a registry/CDN, which the raw 8.2 can understate. The GHSA advisory itself rates the isolated flaw MEDIUM (CVSS 3.1 base 6.4, CVSS 4.0 base 6.1) and labels its exploit maturity as ARBITRARY-WRITE, stating that full RCE only arises when this is chained with the separate F001/F002 bundle-eval issues - so the 'RCE' framing is a chained outcome, not a property of this CVE alone. No CISA KEV listing and no EPSS score are present in the input, so active-exploitation and statistical-exploitation signals are simply absent (not low - absent). A PoC is included, but it demonstrates only the check_hash silent-skip behaviour, not a weaponized end-to-end exploit. Net: a genuine supply-chain integrity weakness worth remediating on the vendor's 'this_week' cadence, but real-world risk hinges on an attacker achieving MITM or registry/CDN compromise, which bounds widespread opportunistic exploitation.

An attacker positioned on a network hop between a MONAI user and a bundle/model host (e.g. MONAI hosting, NGC, or GitHub releases), or who has compromised one of those registries/CDNs, substitutes a downloaded bundle, dataset, or model archive with a malicious one. Because these download paths call check_hash with hash_val=None, the integrity check silently returns True and the swapped file is accepted; a public PoC reference exists demonstrating the silent skip, though it is not verified as working end-to-end exploit code. The malicious archive can then lead to code execution when processed by MONAI's downstream bundle handling (per the advisory's F001/F002 chain). Exploitation is remote and unauthenticated but requires the attacker to first achieve the MITM or registry-control precondition (reflected as AT:P).