MONAI model bundle logging configuration could execute code during loading

MONAI model bundle loading passed an included logging.conf through Python logging.config.fileConfig before the model was initialized.

The operator must load an attacker-controlled or substituted model bundle with a crafted logging handler expression; a legitimate diagnostic request is not sufficient. Executable Python handler configuration can perform host-side actions during bundle import, even before a model run.

The advisory reports a 1.6.1 remediation but version metadata is inconsistent; no poisoned hospital model or clinical compromise was verified. Treat model bundles as executable software, verify their provenance, exclude untrusted logging configuration and test the exact repaired wheels before deployment.

Evidence interpretation and control boundary. A model bundle is not merely a collection of weights: it can carry executable framework configuration evaluated before inference. The logging.config.fileConfig loader interprets handler expressions with process authority. Artifact signatures or proven provenance would address substitution risk, whereas model-output moderation cannot prevent import-time Python execution. The advisory’s inconsistent fixed-version metadata requires explicit wheel-level verification.