CVE-2026-100846: MONAI before 1.5.2 Remote Code Execution via Pickle Deserialization
MONAI before 1.5.2 contains a deserialization of untrusted data vulnerability in the algofrompickle function in monai/auto3dseg/utils.py. The function reads a .pkl file and passes its contents to pickle.loads without validating the data source or content. If an application invokes algofrompickle on an attacker-supplied pickle file, an object defining reduce is executed during deserialization, resulting in arbitrary code execution in the context of the application.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to exploitation?
Deployments using MONAI before 1.5.2 are exposed only if their application calls algo_from_pickle with a pickle file supplied by an attacker or obtained from an untrusted source.
What must an attacker be able to do?
An attacker needs to cause the application to deserialize a crafted .pkl file through algo_from_pickle. Exploitation also requires user interaction and high privileges, as reflected in the supplied vector.
What can be done if upgrading is not immediately possible?
Do not pass untrusted or attacker-controlled .pkl files to algo_from_pickle. Restrict the function to pickle files from trusted, controlled sources.
How can I determine whether my application is affected?
Check whether MONAI is earlier than 1.5.2 and whether application code invokes monai/auto3dseg/utils.py's algo_from_pickle on files whose source or contents are not validated.