Find a vulnerability

{
  "affected": [
    {
      "ecosystem_specific": {},
      "package": {
        "ecosystem": "PyPI",
        "name": "monai",
        "purl": "pkg:pypi/monai"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.6.1rc0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.0.1",
        "0.1.0",
        "0.2.0",
        "0.3.0",
        "0.4.0",
        "0.5.0",
        "0.5.1",
        "0.5.2",
        "0.5.3",
        "0.6.0",
        "0.7.0",
        "0.8.0",
        "0.8.1",
        "0.9.0",
        "0.9.1",
        "1.0.0",
        "1.0.1",
        "1.1.0",
        "1.2.0",
        "1.3.0",
        "1.3.1",
        "1.3.2",
        "1.3.2rc1",
        "1.3.3rc1",
        "1.4.0",
        "1.4.0rc1",
        "1.4.0rc10",
        "1.4.0rc11",
        "1.4.0rc12",
        "1.4.0rc2",
        "1.4.0rc3",
        "1.4.0rc4",
        "1.4.0rc5",
        "1.4.0rc6",
        "1.4.0rc7",
        "1.4.0rc8",
        "1.4.0rc9",
        "1.4.1rc1",
        "1.5.0",
        "1.5.0rc1",
        "1.5.1",
        "1.5.2",
        "1.5.2rc1",
        "1.6.0"
      ]
    }
  ],
  "aliases": [
    "CVE-2026-100840",
    "GHSA-873f-pvrv-4x83"
  ],
  "details": "MONAI through 1.6.0 contains a remote code execution vulnerability in the bundle configuration engine that resolves _target_ values to arbitrary importable callables without an allow list and passes $ expressions to Python eval(). Attackers can publish a malicious bundle with crafted configuration containing arbitrary code that executes when a victim loads the bundle using monai.bundle.load() or monai.bundle.run().",
  "id": "PYSEC-2026-4015",
  "modified": "2026-10-01T08:46:46.152207Z",
  "published": "2026-09-27T02:17:22.387Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.vulncheck.com/advisories/monai-through-1.6.0-remote-code-execution-via-bundle-configuration"
    },
    {
      "type": "EVIDENCE",
      "url": "https://github.com/Project-MONAI/MONAI/security/advisories/GHSA-873f-pvrv-4x83"
    }
  ],
  "severity": [
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}