# CVE-2026-109361: MONAI nnUNetV2Runner insecure deserialization in postprocessing

Source: https://junglewise.ai/threats/cve-2026-109361-monai-1-2-0-before-1-6-1-contains-an-insecure-deserialization  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-12. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-109361 · Severity: high · CVSS 7.3 · Published 2026-10-12

MONAI is a medical imaging AI framework used to train and run neural networks on patient scans. The nnUNetV2Runner component deserializes untrusted pickle files referenced in configuration without validating the file path, allowing an attacker who can modify the results directory to execute arbitrary code when postprocessing runs. This could lead to data theft, model tampering, or lateral movement on shared research infrastructure.

Technologies: [Project-MONAI MONAI](https://junglewise.ai/threats/technologies/project-monai-monai). Vendors: [Project-MONAI](https://junglewise.ai/threats/vendors/project-monai).

## Quick answers

**Is CVE-2026-109361 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-109361 being exploited in the wild.

**How severe is CVE-2026-109361?** High severity, with a CVSS score of 7.3, published 12 October 2026.

**Which products and versions are affected?** Project-MONAI MONAI 1.2.0 before 1.6.1.

**Is there a fix for CVE-2026-109361?** Yes: fixed in 1.6.1. Until then: Set the MONAI_ALLOW_PICKLE environment variable to an explicit opt-in value; restrict write access to the nnU-Net results directory to prevent untrusted actors from modifying inference_information.json or planting malicious pickle files. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-109361 attacked?** It is attacked with local access.

**Am I affected by CVE-2026-109361?** Check whether you run Project-MONAI MONAI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 1.6.1

Set the MONAI_ALLOW_PICKLE environment variable to an explicit opt-in value; restrict write access to the nnU-Net results directory to prevent untrusted actors from modifying inference_information.json or planting malicious pickle files.

## Technical details

nnUNetV2Runner unpickles the postprocessing_file path read from inference_information.json without confining it to the results directory or applying safe-loading restrictions. An attacker who can write to the nnU-Net results directory can plant a malicious pickle file and modify the JSON configuration to point to it, triggering arbitrary code execution via pickle's __reduce__ method when predict_ensemble_postprocessing() runs. The vulnerability is a variant of known pickle-deserialization flaws, but evaded existing grep-based hardening because the pickle.load call is aliased through batchgenerators.

## Affected products

- Project-MONAI MONAI 1.2.0 before 1.6.1

## Timeline

- 2026-09-27: disclosed
- 2026-09-16: patched: Fix committed; released in 1.6.1 on 2026-10-12
- 2026-10-12: advisory

## References

- [https://github.com/Project-MONAI/MONAI/commit/08576205c4de3c214976294d1dec8f7b2e78cdb9](https://github.com/Project-MONAI/MONAI/commit/08576205c4de3c214976294d1dec8f7b2e78cdb9)
- [https://github.com/Project-MONAI/MONAI/security/advisories/GHSA-8f32-8649-rv87](https://github.com/Project-MONAI/MONAI/security/advisories/GHSA-8f32-8649-rv87)

## Related threats

- [MONAI Auto3DSeg remote code execution via algo_from_json](https://junglewise.ai/threats/cve-2026-119578-monai-from-1-6-0-before-1-6-1-contains-a-remote-code-execution)
- [MONAI check_hash insufficient integrity verification](https://junglewise.ai/threats/cve-2026-118684-monai-before-1-6-1-contains-an-insufficient-integrity)
- [MONAI ConfigWorkflow remote code execution in logging.conf](https://junglewise.ai/threats/cve-2026-118683-monai-from-1-2-0-before-1-6-1-contains-a-remote-code-execution)
- [MONAI remote code execution in SENet pretrained weight loading](https://junglewise.ai/threats/cve-2026-109360-monai-0-4-0-before-1-6-1-contains-a-remote-code-execution)
- [MONAI unsafe deserialization in algo_from_pickle](https://junglewise.ai/threats/cve-2026-100846-monai-before-1-5-2-contains-a-deserialization-of-untrusted-data)