Technical impact
The vulnerability lies in the algo_from_pickle() function of MONAI prior to version 1.6.0 where an unsafe pickle.loads() call is used to deserialize data from a pickle file. Attackers can craft malicious pickle payloads that, when processed by the vulnerable function, trigger the execution of arbitrary system commands. This flaw allows an attacker who can provide the pickle file to the function to gain executable code execution on the host running the MONAI application, compromising confidentiality, integrity, and availability of that system.
Affected Systems
The impact spans the Project‑MONAI MONAI library for all versions before 1.6.0. No granular sub‑version cut‑offs are listed; any installation of MONAI < 1.6.0 that exposes the algo_from_pickle() function is vulnerable.
Risk and Exploitability
The recommended CVSS score of 8.5 classifies this as a high‑severity vulnerability. The EPSS score is not available, and the issue is not currently listed in the CISA KEV catalog. Exploitation requires the attacker to supply a malicious pickle file to a process invoking algo_from_pickle(); thus the attack vector is application‑level input. Successful exploitation results in remote code execution on the target system.
