MONAI before 1.6.0 contains an unsafe deserialization flaw in the NumpyReader class that automatically loads *.npy and *.npz files with numpy.load using allow_pickle=True. Because attackers can craft malicious files containing pickle payloads, loading such files through MONAI's standard data pipeline can trigger arbitrary code execution. The vulnerability is a classic example of deserialization of untrusted data (CWE-502) and poses a severe threat to confidentiality, integrity, and availability of any system that processes external .npy or .npz files with MONAI.

The affected product is Project-MONAI MONAI, version 1.6.0 or earlier. Any deployment that relies on MONAI's NumpyReader for loading data files is at risk. No specific sub-versions are listed beyond the stated range, so the default assumption is that all releases prior to 1.6.0 contain the flaw.

The CVSS base score of 8.5 indicates high severity, and while an EPSS score is not available, the absence of an exploitation probability does not diminish its potential impact. The vulnerability is not listed in the CISA KEV catalog yet, but the remote code execution potential makes it amenable to exploitation given a file supply channel. The likely attack vector is that an attacker gains the ability to supply a crafted .npy or .npz file to the MONAI pipeline, either via an upload endpoint, data ingestion script, or other file-loading mechanism. Once the file is processed, arbitrary code runs with the privileges of the MONAI process. The risk is therefore high and the opportunity exists in any environment that accepts untrusted data files.