The vulnerability stems from the PersistentDataset class in MONAI 1.6.0, which deserializes cached MetaTensors using pickle.loads without validating the content. When users cache data in a shared or world‑writable cache directory, an attacker can place a malicious pickle file that will be deserialized the next time another user runs a MONAI pipeline. This leads to arbitrary code execution in the context of the affected user. The flaw is identified as CWE‑502.

All released versions of the MONAI Python package are affected, including 1.6.0 and earlier releases. Any installation that stores cached data in a location such as /tmp/monai_cache, an HPC scratch area, or $HOME/.cache/monai can be vulnerable if that directory is writable by users other than the one running the MONAI code. The vendor is Project MONAI (product MONAI).

The known CVSS base score is 8.5, indicating a high severity of potential impact. The EPSS score is not available, but the absence of a patch, coupled with the ability to inject code through a writable cache, makes exploitation plausible in environments where cache directories are shared. The vulnerability is not yet listed in the CISA KEV catalog. Attackers would need local write access to the cache directory; no network attack surface is reported. Given these factors, the risk remains significant for any environment that allows shared cache writes.