Executive brief
MONAI's auto3dseg module contains an incomplete patch for unsafe pickle deserialization in the algo_from_pickle() function, leaving medical AI workflows vulnerable to remote code execution when loading untrusted model files. A previous advisory claimed the vulnerability was fixed in version 1.5.2, but the vulnerable code was never actually modified. Attackers can craft malicious pickle files to execute arbitrary system commands with the privileges of the application.
Technical details
The vulnerability is a deserialization of untrusted data (CWE-502) flaw in monai/auto3dseg/utils.py. The algo_from_pickle() function calls pickle.loads() on untrusted file content at three locations (lines 321, 350, 356) without any validation, filtering, or use of a restricted Unpickler subclass. An attacker who can supply a malicious .pkl file to any application calling algo_from_pickle() can trigger arbitrary code execution through Python's pickle protocol __reduce__ mechanism. The root cause is that validation checks (isinstance/key checks) occur after deserialization, making them ineffective. A previous advisory (GHSA-89gg-p5r5-q6r4) falsely claimed this was patched in v1.5.2, but monai/auto3dseg/utils.py has remained unmodified since 2024-07-12 (18 months before v1.5.2's January 2026 release). The fix was implemented in v1.6.0. Attack vector is local with low complexity and no privileges required, though user interaction is needed to load the malicious file.
Affected products
- Project-MONAI MONAI < 1.6.0
Timeline
- 2026-06-11: disclosed
- 2026-08-18: advisory
- 2026-01-29: patched: v1.6.0 released with actual fix (v1.5.2 claim was false)
References
- https://api.github.com/users/aslein1413-sys
- https://github.com/aslein1413-sys
- https://api.github.com/users/aslein1413-sys/gists%7B/gist_id%7D
- https://api.github.com/users/aslein1413-sys/repos
- https://avatars.githubusercontent.com/u/247496863?v=4
- https://api.github.com/users/aslein1413-sys/events%7B/privacy%7D