CVE-2026-100842 is an eval injection flaw in MONAI through 1.6.0. The record scores it 7.0 (High); the GitHub advisory rates it Low (6.0). A crafted bundle can run code in a non-default flow. The advisory lists no patched version, so avoid untrusted bundles.
What's affected
The weakness is CWE-95 (eval injection). The record says MONAI through 1.6.0 is affected, in the function that builds a fake spatial shape inside the bundle scripts module.
The description is this. A helper checks shape expressions by walking the syntax tree and collecting only variable names, and it rejects any name other than the two it expects. The string is then passed to Python eval. An expression built from constants and attribute, subscript or call nodes contains no variable names, so it passes the check. The shape value comes from bundle metadata, which is read by the code path behind the bundle verify_net_in_out command line flow.
Sources disagree on severity. The record lists 7.0 (High). The project's GitHub advisory rates it Low with a CVSS 3.1 and 4.0 base score of 6.0, because it is an internal API, it needs the attacker to influence the shape parameter, and the flow is not the default.
On versions, the advisory lists affected versions as all and patched versions as none, when we reviewed it. We could not confirm a fixed release, so check the MONAI releases page and the advisory for updates.
How to check if you're exposed
Check whether MONAI is installed and which version.
pip show monai
Then check whether you use the affected flow. Search your code and scripts for the bundle verify command, for calls to verify_net_in_out, and for any process that loads bundles from outside your own team. If you only run bundles you built yourself and reviewed, the attacker has no way to influence the metadata.
Where bundles come from model hubs or shared drives, treat them as code. A bundle is a package of configuration and scripts, and the metadata is part of what you are trusting.
The free in-browser dependency scan at gold.safeguard.sh/scan can match a lockfile or manifest against known CVEs without installing anything. The Gold directory page for each CVE lists affected packages and fixes as they are published.
What to do now
- Inventory MONAI installs, including notebooks and training containers.
- Do not run the bundle verify flow on bundles from sources you do not control.
- Review the metadata of third party bundles before use, in particular any shape expressions.
- Run MONAI jobs under a low privilege account with limited file and network access.
- Watch the MONAI repository and the GitHub advisory for a patched release, and upgrade when one is listed.
Why it matters
Eval is dangerous because it executes text as code. A name based allowlist looks safe but is not, since Python lets code reach almost anything through attributes of ordinary objects. The reliable fixes are to parse the expression as data, for example with a literal parser, or to restrict it to a tiny grammar that is checked in full.
Medical imaging teams often pull bundles from public sources, which makes the supply chain angle real even when a flow is not the default. The record does not mark the CVE as known exploited.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Why do the record and the advisory rate it differently?
The record lists 7.0 (High). The maintainers rate it Low at 6.0 because it needs control over metadata and a non-default flow. Use the lower figure for likelihood and the higher for worst case impact.
Is there a fixed version?
The advisory listed none when we reviewed it. Check the releases page for updates and avoid untrusted bundles meanwhile.
Sources
Last reviewed: 18 October 2026.
