Executive brief
MONAI is a deep learning framework widely used for medical imaging analysis. Its NumpyReader component, which automatically loads .npy and .npz files in the standard data pipeline, unconditionally enables Python pickle deserialization. An attacker can achieve arbitrary code execution by distributing a malicious .npy file through shared datasets or supply chains, then having a researcher or system load it via MONAI's LoadImage transform or dataset classes.
Technical details
The vulnerability is a deserialization flaw (CWE-502) in the NumpyReader.read() method at monai/data/image_reader.py line 1276. The code calls np.load(name, allow_pickle=True, **kwargs_), hardcoding allow_pickle=True despite Python's pickle being known to execute arbitrary code via __reduce__ hooks during deserialization. NumpyReader is automatically invoked by the LoadImage transform for .npy/.npz files, integrating the vulnerability into all standard data loading patterns. The allow_pickle parameter is explicitly excluded from user-overridable kwargs (per the docstring), preventing mitigation. A proof-of-concept demonstrates instantiation of a malicious class with a crafted __reduce__ method that executes arbitrary shell commands. The fix, released in version 1.6.0, disables pickle deserialization. Attack requires no authentication or privileges—only that a victim loads a crafted file via MONAI's standard pipeline.
Affected products
- Project-MONAI MONAI < 1.6.0
Timeline
- 2026-06-11: disclosed: Published to GitHub Advisory Database
- 2026-06-11: patched: Fixed in MONAI 1.6.0
References
- https://api.github.com/users/romain-deperne
- https://github.com/romain-deperne
- https://api.github.com/users/romain-deperne/gists%7B/gist_id%7D
- https://api.github.com/users/romain-deperne/repos
- https://avatars.githubusercontent.com/u/61591917?v=4
- https://api.github.com/users/romain-deperne/events%7B/privacy%7D