MONAI Auto3DSeg EUVD-2026-113932

No special product configuration is required - the advisory confirms the code path runs under default configuration, with MONAI_ALLOW_PICKLE unset, unlike the gated .pkl branch. The concrete prerequisite is that the victim must load an attacker-controlled Auto3DSeg work directory containing a crafted algo_object.json (with an attacker-chosen _target_) and a sibling algorithm_templates module, by calling AutoRunner(work_dir) or import_bundle_algo_history(); a cache.yaml with algo_gen: true plus any loadable input.yaml suffices, with no dataset, dataroot, or .run() call needed. Limiting factors: the vector is local (AV:L) and depends on passive user interaction (UI:P) - the victim must obtain and open a malicious artifact - so exploitation requires supply-chain/social-engineering delivery rather than remote network access; no authentication is needed (PR:N). Affected versions are MONAI 1.6.0 (<=1.6.0rc1) before 1.6.1; the complete fix is upgrading to 1.6.1 as stated by the vendor.

Signals point to a credible but conditional threat rather than a mass-exploitation emergency. The CVSS 4.0 base score is 8.5 (High) with VC:H/VI:H/VA:H, and the GHSA advisory confirms arbitrary code execution reachable under default configuration (no MONAI_ALLOW_PICKLE required) at AutoRunner construction time. However, the CVSS 4.0 vector is AV:L/UI:P - this is NOT a network-reachable service bug: despite the description's phrase 'remote code execution,' the attack vector is local and requires the victim to load an attacker-supplied Auto3DSeg work directory, so 'remote' here means attacker-authored artifact (benchmark output, pretrained bundle, collaboration folder) rather than a remotely reachable listener. The GHSA advisory publishes a complete, functional PoC (a malicious algorithm_templates/evil.py plus algo_object.json), which materially raises practical risk. This is not in CISA KEV, so there is no evidence of active exploitation, and no EPSS score was supplied to gauge exploitation probability - treat the absence of KEV/EPSS as missing data, not as reassurance. The vuln.today decision label is 'this_week,' consistent with a high-impact, default-config, PoC-backed flaw that still depends on social-engineering/supply-chain delivery. Net: a genuine priority for MONAI/Auto3DSeg users who ingest shared work directories, but gated by the user-interaction/artifact-delivery requirement rather than wormable network exposure.

An attacker publishes a shareable Auto3DSeg work directory - framed as a benchmark output, pretrained-algo bundle, or collaboration folder - containing a malicious algorithm_templates/evil.py and an algo_object.json whose _target_ points to the attacker's class. When a researcher loads it with AutoRunner(work_dir) or import_bundle_algo_history(), the class is imported and instantiated at construction time, silently running the attacker's code as the victim user. A complete working PoC is published in the GHSA advisory, and because the vector is local (AV:L) with passive user interaction (UI:P), exploitation hinges on getting the victim to open the crafted directory.