The vulnerability lies in the nnUNetV2Runner component of MONAI, where the library unpickles a file path read from the inference_information.json configuration file without restricting the path to the intended results directory. Because the pickle is deserialized without validation, an attacker who can alter inference_information.json can direct the loader to a malicious pickle file residing elsewhere in the file system. When the predict_ensemble_postprocessing routine executes, the Python pickle will run the embedded code, allowing the attacker to execute arbitrary commands on the host system and fully compromise the application. This flaw is an instance of insecure deserialization (CWE‑502) and can lead to a full remote code execution threat.

The issue affects the MONAI library from Project‑MONAI, with all releases from version 1.2.0 up through but excluding 1.6.1. Users running MONAI versions 1.2.0, 1.3.x, 1.4.x, 1.5.x, and 1.6.0 are susceptible. The vulnerability is present in any deployment that utilizes the nnUNetV2Runner with the postprocessing_file feature.

The CVSS score of 7 indicates moderate severity, but the exploit requires the ability to write to the inference_information.json file, situating it as a local privilege‑elevating or file‑modification scenario. Because EPSS is not available and the vulnerability is not listed in the CISA KEV catalog, it has not yet been observed in widespread exploitation campaigns. Nonetheless, the attack path is straightforward: modify the JSON configuration to point to a crafted pickle, then trigger predict_ensemble_postprocessing to deserialize it, executing arbitrary code on the running host. The resulting impact could be total system compromise if the attacker obtains sufficient privileges on the machine.