The vulnerability exists in MONAI before 1.5.2 due to the usage of pickle.loads to deserialize arbitrary data in the algo_from_pickle function. An attacker can supply a crafted .pkl file containing an object with a __reduce__ method, causing pickle to instantiate the object and execute arbitrary code as the user running the MONAI application. This results in complete loss of confidentiality, integrity, and availability. The weakness corresponds to CWE‑502 (Deserialization of Untrusted Data).

The affected product is MONAI (Project‑MONAI:MONAI) version 1.5.1 and earlier, including any deployments that import and run the algo_from_pickle routine. No specific sub‑modules other than the autoload3dseg utils Python file are affected. The advisory does not mention a broader product family or additional components.

The CVSS score of 8.8 indicates high severity, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog, suggesting no known active exploitation. However, any application that accepts and deserializes user‑supplied pickle files is a likely attack surface. Because the deserialization is performed without source validation, a local or remote attacker who can inject a .pkl file into the application’s file system or data flow can trigger execution of arbitrary Python code under the application’s environment.