CVE-2026-100842
1 advisory.
PyPI/monai CVE-2026-100842: high 8.8, EPSS 0.15%
MONAI through 1.6.0 contains an eval injection vulnerability in _get_fake_spatial_shape() in monai/bundle/scripts.py. The function validates shape expressions with a helper that walks the AST and only
Action: Upgrade monai to 1.6.1rc0 or later.
pip install monai==1.6.1rc0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.6.1rc0 | - |
Fixed versions
| 1.6.1rc0 |
Sources
- osv: PYSEC-2026-4017
- https://www.vulncheck.com/advisories/monai-through-1.6.0-get-fake-spatial-shape-eval-sandbox-bypass-via-attribute-chains
- https://github.com/Project-MONAI/MONAI/security/advisories/GHSA-h89g-r5pc-wxfm
CVE-2026-100842 · published · modified · JSON