GHSA-hhh4-h52m-fqh6: MONAI before 1.6.1 Missing Integrity Verification via check_hash in Downloads

Published Oct 28, 2026

Updated

MONAI before 1.6.1 contains an insufficient integrity verification vulnerability in checkhash() that silently returns True when hashval is None, with MD5 as the default hash type. Attackers performing man-in-the-middle or registry compromise can substitute bundles, datasets, or model archives downloaded without hashes, enabling malicious file delivery and potential code execution.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade MONAI to a version that resolves this vulnerability.
Fixed in 1.6.1

Event History

Oct 28, 2026

CVE Published

via OSV·06:59 PM

Data Sourced

via OSV·06:59 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Users of MONAI versions before 1.6.1 are exposed when they download bundles, datasets, or model archives without supplying a hash value. The realistic threat scenarios are a man-in-the-middle position or compromise of the source registry.

What does an attacker need to exploit it?

An attacker needs the ability to substitute content during download, such as through a network man-in-the-middle attack or a compromised registry. No prior authentication or user interaction is required according to the supplied vector, but exploitation depends on a download that lacks a hash value.

What should be done if upgrading is not immediately possible?

Ensure every downloaded bundle, dataset, and model archive has a supplied integrity hash and verify it before use. Avoid relying on downloads for which the hash value is absent, because check_hash() returns True in that condition.

How can I determine whether my environment is affected?

Check whether the MONAI version is earlier than 1.6.1 and review download workflows for calls that do not provide hash_val. Such downloads are affected because the integrity check silently succeeds when hash_val is None.

GHSA-hhh4-h52m-fqh6: MONAI before 1.6.1 Missing Integrity Verification via check_hash in Downloads

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What should be done if upgrading is not immediately possible?

How can I determine whether my environment is affected?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What should be done if upgrading is not immediately possible?

How can I determine whether my environment is affected?