MONAI algo_from_pickle RCE via pickle deserialization

Severity: high · CVSS 7.8 · Published 2026-08-18

MONAI's auto3dseg module contains an incomplete patch for unsafe pickle deserialization in the algo_from_pickle() function, leaving medical AI workflows vulnerable to remote code execution when loading untrusted model files. A previous advisory claimed the vulnerability was fixed in version 1.5.2, but the vulnerable code was never actually modified. Attackers can craft malicious pickle files to execute arbitrary system commands with the privileges of the application.

Technologies: monai (PyPI). Vendors: PyPI.

Quick answers

Is This vulnerability exploited in the wild?
No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?
High severity, with a CVSS score of 7.8, published 18 August 2026.
Which products and versions are affected?
monai (PyPI) < 1.6.0.
Is there a fix for This vulnerability?
A patch was published on 2026-01-29: v1.6.0 released with actual fix (v1.5.2 claim was false) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?
It is attacked with local access, in a software library.
Am I affected?
Check whether you run monai (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a deserialization of untrusted data (CWE-502) flaw in monai/auto3dseg/utils.py. The algo_from_pickle() function calls pickle.loads() on untrusted file content at three locations (lines 321, 350, 356) without any validation, filtering, or use of a restricted Unpickler subclass. An attacker who can supply a malicious .pkl file to any application calling algo_from_pickle() can trigger arbitrary code execution through Python's pickle protocol __reduce__ mechanism. The root cause is that validation checks (isinstance/key checks) occur after deserialization, making them ineffective. A previous advisory (GHSA-89gg-p5r5-q6r4) falsely claimed this was patched in v1.5.2, but monai/auto3dseg/utils.py has remained unmodified since 2024-07-12 (18 months before v1.5.2's January 2026 release). The fix was implemented in v1.6.0. Attack vector is local with low complexity and no privileges required, though user interaction is needed to load the malicious file.

Affected products

  • Project-MONAI MONAI < 1.6.0

Timeline

  • 2026-06-11: disclosed
  • 2026-08-18: advisory
  • 2026-01-29: patched: v1.6.0 released with actual fix (v1.5.2 claim was false)

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.