Executive brief
MONAI, a framework for medical AI, is vulnerable to a security flaw when loading pre-trained models or checkpoints. If a user loads a specially crafted malicious model file, an attacker could execute arbitrary commands on the system. This could lead to full system compromise, data theft, or unauthorized access to sensitive medical research environments.
Technical details
A deserialization vulnerability exists in MONAI due to the use of 'torch.load' without the 'weights_only=True' parameter in certain components, specifically within the CheckpointLoader handler. While some parts of the project were updated to use secure loading, other areas remain vulnerable to the execution of arbitrary Python code embedded in malicious pickle-based checkpoint files. An attacker can exploit this by providing a crafted checkpoint file that, when loaded by a user or automated process, triggers the '__reduce__' method to execute system commands. This vulnerability is tracked as CVE-2025-58756 and is addressed in version 1.5.1.
Affected products
- Project-MONAI monai <= 1.5.0
Timeline
- 2025-09-08: disclosed: Advisory published by Project-MONAI
- 2025-09-09: advisory: NVD and GitHub Advisory Database entries created
- 2025-09-09: patched: Fix released in version 1.5.1