Executive brief
MONAI, a popular open-source framework for medical AI, contains a vulnerability that could allow an attacker to execute malicious code on a user's system. This occurs when the software processes specially crafted data files, such as medical datasets or AI models, from untrusted sources. An exploit could lead to full system compromise, unauthorized access to sensitive medical data, or disruption of research operations.
Technical details
A deserialization vulnerability (CWE-502) exists in the `pickle_operations` function within `monai/data/utils.py`. The function automatically identifies dictionary keys with specific suffixes and processes their values using `pickle.loads()` without validation. An attacker can exploit this by providing a malicious dataset or serialized file that, when processed by functions like `list_data_collate` during batch training or data loading, triggers arbitrary code execution. The vulnerability is reachable if a user is enticed to load or process untrusted data. This issue is addressed in version 1.5.1.
Affected products
- Project-MONAI MONAI <= 1.5.0
Timeline
- 2025-09-08: disclosed: Advisory published by Project-MONAI
- 2025-09-09: advisory: GitHub Advisory and NVD publication
- 2025-09-09: patched: Version 1.5.1 released