PYSEC-2026-4017

MONAI through 1.6.0 contains an eval injection vulnerability in getfakespatialshape in monai/bundle/scripts.py. The function validates shape expressions with a helper that walks the AST and only collects ast.Name nodes, rejecting any name other than 'p' or 'n', before passing the string to eval...

PYSEC-2026-4018

MONAI versions before 1.6.0 contain a remote code execution vulnerability in the algofrompickle function due to unsafe pickle.loads deserialization in monai/auto3dseg/utils.py. Attackers can craft malicious pickle files that execute arbitrary system commands when deserialized by the vulnerable...

PYSEC-2026-4019

MONAI before 1.6.0 is vulnerable to OS command injection in the nnUNetV2Runner component monai.apps.nnunet.nnunetv2runner. User-controlled values taken from the YAML configuration file notably datasetnameorid and from CLI/kwargs arguments are concatenated into a command string without quoting or...

PYSEC-2026-4016

In MONAI 1.6.0, PersistentDataset monai/data/dataset.py explicitly rejects the combination trackmeta=True with weightsonly=True, forcing users who cache MetaTensors the default tensor type in MONAI = 1.0 to run torch.loadhashfile, weightsonly=False. Related cache helpers in monai/data/utils.py al...

PYSEC-2026-4015

MONAI through 1.6.0 contains a remote code execution vulnerability in the bundle configuration engine that resolves target values to arbitrary importable callables without an allow list and passes $ expressions to Python eval. Attackers can publish a malicious bundle with crafted configuration...

EUVD-2026-87842

MONAI before 1.5.2 contains a deserialization of untrusted data vulnerability in the algofrompickle function in monai/auto3dseg/utils.py. The function reads a .pkl file and passes its contents to pickle.loads without validating the data source or content. If an application invokes algofrompickle ...

CVE-2026-100846 MONAI before 1.5.2 Remote Code Execution via Pickle Deserialization

MONAI before 1.5.2 contains a deserialization of untrusted data vulnerability in the algofrompickle function in monai/auto3dseg/utils.py. The function reads a .pkl file and passes its contents to pickle.loads without validating the data source or content. If an application invokes algofrompickle ...

CVE-2026-100846

The MONAI library, in versions prior to 1.5.2 , is vulnerable to Remote Code Execution (RCE) due to an insecure deserialization of untrusted data. The flaw exists within the algo_from_pickle function located in monai/auto3dseg/utils.py , which processes .pkl files and passes their contents to pic...

CVE-2026-100846 MONAI before 1.5.2 Remote Code Execution via Pickle Deserialization

MONAI before 1.5.2 contains a deserialization of untrusted data vulnerability in the algofrompickle function in monai/auto3dseg/utils.py. The function reads a .pkl file and passes its contents to pickle.loads without validating the data source or content. If an application invokes algofrompickle ...

CVE-2026-100845 MONAI before 1.6.0 Remote Code Execution via NumpyReader

MONAI before 1.6.0 contains an unsafe deserialization vulnerability in the NumpyReader class that unconditionally uses numpy.load with allowpickle=True when loading .npy and .npz files. Attackers can craft malicious .npy files with pickle payloads that execute arbitrary code when loaded through...

EUVD-2026-87843

MONAI before 1.6.0 contains an unsafe deserialization vulnerability in the NumpyReader class that unconditionally uses numpy.load with allowpickle=True when loading .npy and .npz files. Attackers can craft malicious .npy files with pickle payloads that execute arbitrary code when loaded through...

CVE-2026-100845 MONAI before 1.6.0 Remote Code Execution via NumpyReader

MONAI before 1.6.0 contains an unsafe deserialization vulnerability in the NumpyReader class that unconditionally uses numpy.load with allowpickle=True when loading .npy and .npz files. Attackers can craft malicious .npy files with pickle payloads that execute arbitrary code when loaded through...

CVE-2026-100845

MONAI versions prior to 1.6.0 are vulnerable to Remote Code Execution (RCE) due to an unsafe deserialization flaw in the NumpyReader class. The root cause is the unconditional use of numpy.load with allow_pickle=True when processing .npy and .npz files. An attacker can craft malicious files conta...

CVE-2026-100845 MONAI before 1.6.0 Remote Code Execution via NumpyReader

MONAI before 1.6.0 contains an unsafe deserialization vulnerability in the NumpyReader class that unconditionally uses numpy.load with allowpickle=True when loading .npy and .npz files. Attackers can craft malicious .npy files with pickle payloads that execute arbitrary code when loaded through...

CVE-2026-100844 MONAI before 1.6.0 OS Command Injection via dataset_name_or_id

MONAI before 1.6.0 is vulnerable to OS command injection in the nnUNetV2Runner component monai.apps.nnunet.nnunetv2runner. User-controlled values taken from the YAML configuration file notably datasetnameorid and from CLI/kwargs arguments are concatenated into a command string without quoting or...

EUVD-2026-87844

MONAI before 1.6.0 is vulnerable to OS command injection in the nnUNetV2Runner component monai.apps.nnunet.nnunetv2runner. User-controlled values taken from the YAML configuration file notably datasetnameorid and from CLI/kwargs arguments are concatenated into a command string without quoting or...

CVE-2026-100844

MONAI versions prior to 1.6.0 are vulnerable to an OS command injection flaw within the nnUNetV2Runner component (monai.apps.nnunet.nnunetv2_runner). The root cause is the insecure concatenation of user-controlled values from YAML configuration files (specifically dataset_name_or_id) and CLI/kwar...

CVE-2026-100844 MONAI before 1.6.0 OS Command Injection via dataset_name_or_id

MONAI before 1.6.0 is vulnerable to OS command injection in the nnUNetV2Runner component monai.apps.nnunet.nnunetv2runner. User-controlled values taken from the YAML configuration file notably datasetnameorid and from CLI/kwargs arguments are concatenated into a command string without quoting or...

CVE-2026-100844 MONAI before 1.6.0 OS Command Injection via dataset_name_or_id

MONAI before 1.6.0 is vulnerable to OS command injection in the nnUNetV2Runner component monai.apps.nnunet.nnunetv2runner. User-controlled values taken from the YAML configuration file notably datasetnameorid and from CLI/kwargs arguments are concatenated into a command string without quoting or...

CVE-2026-100843 MONAI before 1.6.0 Remote Code Execution via algo_from_pickle

MONAI versions before 1.6.0 contain a remote code execution vulnerability in the algofrompickle function due to unsafe pickle.loads deserialization in monai/auto3dseg/utils.py. Attackers can craft malicious pickle files that execute arbitrary system commands when deserialized by the vulnerable...