Threats tagged 'ghsa-475h-4rfw-9899'

MONAI versions from 1.2.0 up to but not including 1.6.1 contain a remote code execution vulnerability in the ConfigWorkflow.__init__ method. This vulnerability arises because the method passes a bundle's configs/logging.conf file to logging.config.fileConfig, which uses eval() on handler class and args fields. An attacker can exploit this by publishing a malicious bundle with a crafted logging.conf that executes arbitrary Python code when the victim loads or runs the bundle.