What is GHSA-rx25-w8hq-hr3g?

GHSA-rx25-w8hq-hr3g is a security advisory published by GitHub Security Advisories with High severity. MONAI from 1.6.0 before 1.6.1 contains a remote code execution vulnerability in Auto3DSeg...

Which CVE IDs does GHSA-rx25-w8hq-hr3g cover?

GHSA-rx25-w8hq-hr3g covers the following CVE IDs: CVE-2026-119578. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-rx25-w8hq-hr3g?

GHSA-rx25-w8hq-hr3g has a CVSS v3 base score of 7.8, published by GitHub Security Advisories.

GHSA-rx25-w8hq-hr3gHighCVSS 7.8

MONAI from 1.6.0 before 1.6.1 contains a remote code execution vulnerability in Auto3DSeg...

Vendor

GitHub Security Advisories

Published

October 30, 2026

Last Modified

October 30, 2026

🔗 CVE IDs covered (1)

CVE-2026-119578 →

📋 Description

MONAI from 1.6.0 before 1.6.1 contains a remote code execution vulnerability in Auto3DSeg algo_from_json() that allows attackers to run Python code via a crafted work directory's algo_object.json. Attackers can ship a malicious algorithm_templates module plus a target name that is imported and instantiated when victims call AutoRunner or import_bundle_algo_history, executing code under default configuration.

🔗 References (4)

https://github.com/Project-MONAI/MONAI/security/advisories/GHSA-2wx3-8x3w-r8qv
https://nvd.nist.gov/vuln/detail/CVE-2026-119578
https://www.vulncheck.com/advisories/monai-1.6.0-before-1.6.1-code-execution-via-auto3dseg-algo-from-json
https://github.com/advisories/GHSA-rx25-w8hq-hr3g