CVE-2026-100843: Deserialization of Untrusted Data

MONAI versions before 1.6.0 contain a remote code execution vulnerability in the algofrompickle function due to unsafe pickle.loads deserialization in monai/auto3dseg/utils.py. Attackers can craft malicious pickle files that execute arbitrary system commands when deserialized by the vulnerable...

CVE-2026-100840: Improper Neutralization of Directives in Dynamically Evaluated Code

MONAI through 1.6.0 contains a remote code execution vulnerability in the bundle configuration engine that resolves target values to arbitrary importable callables without an allow list and passes $ expressions to Python eval. Attackers can publish a malicious bundle with crafted configuration...

PT-2026-105780

MONAI before 1.6.0 is vulnerable to OS command injection in the nnUNetV2Runner component monai.apps.nnunet.nnunetv2 runner. User-controlled values taken from the YAML configuration file notably dataset name or id and from CLI/kwargs arguments are concatenated into a command string without quoting...

PT-2026-99461

Name of the Vulnerable Software and Affected Versions monai affected versions not specified Description In the PersistentDataset function within monai/data/dataset.py, the software rejects the simultaneous use of track meta=True and weights only=True. This forces users caching MetaTensors to use...

CVE-2026-100841: Deserialization of Untrusted Data

In MONAI 1.6.0, PersistentDataset monai/data/dataset.py explicitly rejects the combination trackmeta=True with weightsonly=True, forcing users who cache MetaTensors the default tensor type in MONAI = 1.0 to run torch.loadhashfile, weightsonly=False. Related cache helpers in monai/data/utils.py al...

PT-2026-105777

In MONAI 1.6.0, PersistentDataset monai/data/dataset.py explicitly rejects the combination track meta=True with weights only=True, forcing users who cache MetaTensors the default tensor type in MONAI = 1.0 to run torch.loadhashfile, weights only=False. Related cache helpers in monai/data/utils.py...

PT-2026-105779

MONAI versions before 1.6.0 contain a remote code execution vulnerability in the algo from pickle function due to unsafe pickle.loads deserialization in monai/auto3dseg/utils.py. Attackers can craft malicious pickle files that execute arbitrary system commands when deserialized by the vulnerable...

PT-2026-99460

Name of the Vulnerable Software and Affected Versions MONAI versions prior to 1.6.1 Description The bundle configuration engine allows remote code execution because it resolves target values to arbitrary importable callables without using an allow list and passes $ expressions to the Python eval...

PT-2026-99462

Name of the Vulnerable Software and Affected Versions MONAI versions prior to 1.6.1 Description An eval injection exists in the get fake spatial shape function within monai/bundle/scripts.py. The function uses a helper to validate shape expressions by walking the Abstract Syntax Tree AST and only...

PT-2026-105782

MONAI before 1.5.2 contains a deserialization of untrusted data vulnerability in the algo from pickle function in monai/auto3dseg/utils.py. The function reads a .pkl file and passes its contents to pickle.loads without validating the data source or content. If an application invokes algo from...

CVE-2026-100845: Deserialization of Untrusted Data

MONAI before 1.6.0 contains an unsafe deserialization vulnerability in the NumpyReader class that unconditionally uses numpy.load with allowpickle=True when loading .npy and .npz files. Attackers can craft malicious .npy files with pickle payloads that execute arbitrary code when loaded through...

CVE-2026-100846: Deserialization of Untrusted Data

MONAI before 1.5.2 contains a deserialization of untrusted data vulnerability in the algofrompickle function in monai/auto3dseg/utils.py. The function reads a .pkl file and passes its contents to pickle.loads without validating the data source or content. If an application invokes algofrompickle ...

PT-2026-105778

MONAI through 1.6.0 contains an eval injection vulnerability in get fake spatial shape in monai/bundle/scripts.py. The function validates shape expressions with a helper that walks the AST and only collects ast.Name nodes, rejecting any name other than 'p' or 'n', before passing the string to eva...

PT-2026-105776

MONAI through 1.6.0 contains a remote code execution vulnerability in the bundle configuration engine that resolves target values to arbitrary importable callables without an allow list and passes $ expressions to Python eval. Attackers can publish a malicious bundle with crafted configuration...

PT-2026-105781

MONAI before 1.6.0 contains an unsafe deserialization vulnerability in the NumpyReader class that unconditionally uses numpy.load with allow pickle=True when loading .npy and .npz files. Attackers can craft malicious .npy files with pickle payloads that execute arbitrary code when loaded through...

CVE-2026-100842: Improper Neutralization of Directives in Dynamically Evaluated Code

MONAI through 1.6.0 contains an eval injection vulnerability in getfakespatialshape in monai/bundle/scripts.py. The function validates shape expressions with a helper that walks the AST and only collects ast.Name nodes, rejecting any name other than 'p' or 'n', before passing the string to eval...

WS-2026-0034

The algofrompickle function in monai/auto3dseg/utils.py deserializes attacker-controlled data with pickle.loads at three call sites, with isinstance and key validation performed only after deserialization, so remote code execution fires before any check. An earlier advisory stated the issue was...

WS-2026-0033

MONAI is vulnerable to OS command injection in monai/apps/nnunet/nnunetv2runner.py. The runner concatenates user-controlled values from a configuration YAML datasetnameorid or CLI kwargs into a command string without quoting or validation, and the string is passed to subprocess with shell=True, s...

WS-2026-0032

The NumpyReader class in monai/data/imagereader.py unconditionally calls np.loadname, allowpickle=True, enabling arbitrary code execution when loading a crafted .npy or .npz file. The allowpickle parameter was hardcoded to True and could not be overridden by the caller, and NumpyReader is selecte...

MONAI: Unsafe deserialization in NumpyReader allows arbitrary code execution via malicious .npy files

Summary The NumpyReader class in monai/data/imagereader.py unconditionally uses np.loadname, allowpickle=True line 1276, enabling arbitrary code execution when loading a crafted .npy or .npz file. This affects all MONAI versions up to and including the latest commit 5b71547. The allowpickle...