CVE-2026-109361: MONAI 1.2.0 before 1.6.1 Insecure Deserialization RCE via nnUNetV2Runner postprocessing_file Path
MONAI 1.2.0 before 1.6.1 contains an insecure deserialization vulnerability in nnUNetV2Runner that unpickles the postprocessingfile path read from inferenceinformation.json without confining it to the results directory. Attackers who can modify inferenceinformation.json can point it at a malicious pickle elsewhere on the filesystem to execute code when predictensemblepostprocessing runs.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
An attacker must be able to modify the inference_information.json file used by nnUNetV2Runner. They also need to place or reference a malicious pickle file at a filesystem location accessible to the process running predict_ensemble_postprocessing.
When does malicious code execute?
Code execution occurs when predict_ensemble_postprocessing reads inference_information.json and unpickles the postprocessing_file path specified in that file. Exploitation requires a user or workflow to run that postprocessing operation.
Which versions are affected?
MONAI versions from 1.2.0 up to, but not including, 1.6.1 are affected.
What can be done if upgrading is not immediately possible?
Prevent untrusted users or processes from modifying inference_information.json, and ensure its postprocessing_file value cannot reference attacker-controlled pickle files outside the expected results directory. Avoid running predict_ensemble_postprocessing on inference results whose metadata or associated files are not trusted.