MONAI 0.4.0 through 1.6.0 contains a remote code execution vulnerability that allows on‑path attackers to manipulate pretrained weight files fetched over plaintext HTTP. An attacker can replace the .pth file with a crafted pickle that, when load_state_dict_from_url is called without weights_only=True, executes arbitrary code during the construction of SENet models with pretrained=True. This lets an attacker run code with the privileges of the process loading the model, potentially compromising confidentiality, integrity, and availability of the system.

MONAI framework versions 0.4.0 up to 1.6.0 inclusive are affected. Users deploying those versions and instantiating SENet or other pretrained models are at risk. Versions 1.6.1 and later are not vulnerable.

CVSS score of 7.7 indicates high severity. The EPSS score is not available, so current exploitation frequency cannot be quantified. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector relies on an on‑path network condition that permits an attacker to replace the HTTP response with a malicious pickle file; a man‑in‑the‑middle attacker on the HTTP channel can trigger execution immediately when the model is constructed.