CVE-2026-100846

MONAI before 1.5.2 Remote Code Execution via Pickle Deserialization

Published Sep 27, 2026 CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed

Description

MONAI before 1.5.2 contains a deserialization of untrusted data vulnerability in the algo_from_pickle function in monai/auto3dseg/utils.py. The function reads a .pkl file and passes its contents to pickle.loads without validating the data source or content. If an application invokes algo_from_pickle on an attacker-supplied pickle file, an object defining __reduce__ is executed during deserialization, resulting in arbitrary code execution in the context of the application.

Analysis

Technical impact

The vulnerability exists in MONAI before 1.5.2 due to the usage of pickle.loads to deserialize arbitrary data in the algo_from_pickle function. An attacker can supply a crafted .pkl file containing an object with a __reduce__ method, causing pickle to instantiate the object and execute arbitrary code as the user running the MONAI application. This results in complete loss of confidentiality, integrity, and availability. The weakness corresponds to CWE‑502 (Deserialization of Untrusted Data).

Affected Systems

The affected product is MONAI (Project‑MONAI:MONAI) version 1.5.1 and earlier, including any deployments that import and run the algo_from_pickle routine. No specific sub‑modules other than the autoload3dseg utils Python file are affected. The advisory does not mention a broader product family or additional components.

Risk and Exploitability

The CVSS score of 8.8 indicates high severity, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog, suggesting no known active exploitation. However, any application that accepts and deserializes user‑supplied pickle files is a likely attack surface. Because the deserialization is performed without source validation, a local or remote attacker who can inject a .pkl file into the application’s file system or data flow can trigger execution of arbitrary Python code under the application’s environment.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Project-MONAI

MONAI

unaffected

Version	Status	Constraints
`0`	affected	< 1.5.2
`1.5.2`	unaffected	—

Configuration 1 [-]

cpe:2.3:a:project-monai:monai:*:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Project-monai

Monai

Version	Status	Scheme	Platform
`[0,1.5.2)`	affected	semver	—
`1.5.2`	unaffected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update MONAI to version 1.5.2 or later, removing the insecure algo_from_pickle usage.
If an update is not feasible, eliminate or disable calls to algo_from_pickle in the application and replace them with a secure file loading mechanism that does not use pickle.
As a temporary hardening measure, validate incoming .pkl files with a whitelist or reject all untrusted pickle data before deserialization.

Generated by OpenCVE AI on September 27, 2026 at 03:47 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity High

Privileges Required High

Attack Requirements Present

User Interaction Passive

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact High

Subsequent System Integrity Impact High

Subsequent System Availability Impact High

Attack Vector Network

Attack Complexity High

Privileges Required High

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.361% probability within 30 days)

Exploitation poc

Automatable no

Technical Impact total

References

Link	Providers
https://github.com/Project-MONAI/MONAI/security/advisories/GHSA-89gg-p5r5-q6r4
https://www.vulncheck.com/advisories/monai-before-1.5.2-remote-code-execution-via-pickle-deserialization

History

Oct 8, 2026 5:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Sep 27, 2026 2:00 AM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		MONAI before 1.5.2 contains a deserialization of untrusted data vulnerability in the algo_from_pickle function in monai/auto3dseg/utils.py. The function reads a .pkl file and passes its contents to pickle.loads without validating the data source or content. If an application invokes algo_from_pickle on an attacker-supplied pickle file, an object defining __reduce__ is executed during deserialization, resulting in arbitrary code execution in the context of the application.
Title		MONAI before 1.5.2 Remote Code Execution via Pickle Deserialization
First Time appeared		Project-monai Project-monai monai
Weaknesses		CWE-502
CPEs		cpe:2.3:a:project-monai:monai::::::::
Vendors & Products		Project-monai Project-monai monai
References		https://github.com/Project-MONAI/MONAI/security/advisories/GHSA-89gg-p5r5-q6r4 https://www.vulncheck.com/advisories/monai-before-1.5.2-remote-code-execution-via-pickle-deserialization
Metrics		cvssV3_1 `{'score': 7.6, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H'}` cvssV4_0 `{'score': 8.8, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H'}`