Evidence · DiggingBeagle record
MONAI bundled logging configuration executable code advisory
Maintainer advisory on Python logging configuration interpretation when loading an AI model bundle.
- Source role
- primary disclosure
Evidence record
Maintainer advisory on Python logging configuration interpretation when loading an AI model bundle.
Claim-level citations (2)
- supportsMONAI model bundle logging configuration could execute code during loading: The MONAI advisory describes evaluation of bundle-provided logging.conf handler expressions during workflow load, before model execution, with a reported 1.6.1 remediation whose package metadata needs reconciliation.
GHSA-wvpx-5qmp-46g3: ConfigWorkflow, logging.conf fileConfig import behavior and version metadata
- supportsMONAI model bundle logging configuration could execute code during loading: MONAI model bundle loading passed an included logging.conf through Python logging.config.fileConfig before the model was initialized. The operator must load an attacker-controlled or substituted model bundle with a crafted logging handler expression; a legitimate diagnostic request is not sufficient. Executable Python handler configuration can perform host-side actions during bundle import, even before a model run.
GHSA-wvpx-5qmp-46g3: ConfigWorkflow, logging.conf fileConfig import behavior and version metadata