MONAI EUVD-2026-112388

Exploitation requires the victim to obtain and load an attacker-controlled MONAI bundle through any entrypoint that constructs a workflow - monai.bundle.load() (the 'load weights' verb), monai.bundle.run(), run_workflow(), create_workflow(), or direct ConfigWorkflow(config_file=...) - and the bundle must contain a configs/logging.conf file. No special non-default configuration is needed: ConfigWorkflow.__init__ defaults logging_file to the bundle's own configs/logging.conf and calls logging.config.fileConfig() on it with no trust check, so the default behavior is vulnerable whenever that file is present; the payload fires at object construction, before initialize() or run(), and independently of any MONAI $-expression in the main config. The principal limiting factor is user interaction (CVSS UI:A): the attacker cannot reach a target that never loads their bundle, making this a supply-chain/social-engineering vector rather than direct remote exploitation; no authentication is required of the victim (PR:N) and code runs with the loading user's privileges. Setting logging_file=False disables the fileConfig call per the code.

This is a genuine high-priority issue rather than a CVSS-inflated one, though its real-world reach is gated by user interaction. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A, VC:H/VI:H/VA:H, score 8.6) describes a network-reachable, low-complexity, unauthenticated flaw with full confidentiality/integrity/availability impact, but the UI:A (Active user interaction) metric is decisive: exploitation requires a victim to deliberately load or run an attacker-published MONAI bundle, so this is a supply-chain social-engineering vector, not a wormable remote service bug. Exploit maturity is strong: the GHSA advisory ships a complete working PoC and reports a successful dynamic reproduction (ATTACKER_CODE_RAN: True, live id -u/whoami output), so publicly available exploit code exists and is confirmed functional. The vuln.today decision label is this_week. Two signals are absent: no EPSS score is provided in the input, and there is no CISA KEV listing, so there is no evidence of active in-the-wild exploitation despite the confirmed PoC - the current risk is 'proven-exploitable, not yet observed exploited.' The signals are internally consistent (network/low-complexity delivery, user-interaction gate, confirmed code execution); the main caveat is that 'network' reach depends entirely on the victim fetching an untrusted bundle.

An attacker publishes a MONAI bundle (e.g. 'coolseg') to a widely-trusted channel such as the model zoo, Hugging Face, or NGC, with a benign-looking train.json and weights but a malicious configs/logging.conf. A researcher or inference service calls monai.bundle.load()/run() on it; during ConfigWorkflow.__init__ the logging.conf is passed to logging.config.fileConfig(), which eval()s the handler class= field and runs the attacker's Python as the victim user. A confirmed working PoC and successful dynamic reproduction are documented in the GHSA advisory.