Threats tagged 'ghsa-rx25-w8hq-hr3g'

MONAI versions from 1.6.0 up to but not including 1.6.1 contain a remote code execution vulnerability in the Auto3DSeg algo_from_json() function. This flaw allows attackers to execute arbitrary Python code by supplying a crafted algo_object.json file within a work directory. Exploitation involves shipping a malicious algorithm_templates module and specifying a _target_ name that is imported and instantiated during calls to AutoRunner or import_bundle_algo_history, leading to code execution under default configurations.