CVE-2026-100845 MONAI before 1.6.0 Remote Code Execution via NumpyReader

MONAI before 1.6.0 contains an unsafe deserialization vulnerability in the NumpyReader class that unconditionally uses numpy.load with allowpickle=True when loading .npy and .npz files. Attackers can craft malicious .npy files with pickle payloads that execute arbitrary code when loaded through...

EUVD-2026-87843

MONAI before 1.6.0 contains an unsafe deserialization vulnerability in the NumpyReader class that unconditionally uses numpy.load with allowpickle=True when loading .npy and .npz files. Attackers can craft malicious .npy files with pickle payloads that execute arbitrary code when loaded through...

CVE-2026-100845

MONAI versions prior to 1.6.0 are vulnerable to Remote Code Execution (RCE) due to an unsafe deserialization flaw in the NumpyReader class. The root cause is the unconditional use of numpy.load with allow_pickle=True when processing .npy and .npz files. An attacker can craft malicious files conta...

EUVD-2026-87846

MONAI through 1.6.0 contains an eval injection vulnerability in getfakespatialshape in monai/bundle/scripts.py. The function validates shape expressions with a helper that walks the AST and only collects ast.Name nodes, rejecting any name other than 'p' or 'n', before passing the string to eval...

CVE-2026-100842 MONAI through 1.6.0 _get_fake_spatial_shape eval() Sandbox Bypass via Attribute Chains

MONAI through 1.6.0 contains an eval injection vulnerability in getfakespatialshape in monai/bundle/scripts.py. The function validates shape expressions with a helper that walks the AST and only collects ast.Name nodes, rejecting any name other than 'p' or 'n', before passing the string to eval...

CVE-2026-100842 MONAI through 1.6.0 _get_fake_spatial_shape eval() Sandbox Bypass via Attribute Chains

MONAI through 1.6.0 contains an eval injection vulnerability in getfakespatialshape in monai/bundle/scripts.py. The function validates shape expressions with a helper that walks the AST and only collects ast.Name nodes, rejecting any name other than 'p' or 'n', before passing the string to eval...

CVE-2026-100842

MONAI versions through 1.6.0 are vulnerable to an eval injection vulnerability within the _get_fake_spatial_shape() function in monai/bundle/scripts.py. The flaw exists because the validation helper only inspects ast.Name nodes, allowing attackers to bypass the sandbox using attribute chains (e.g...

CVE-2026-100843 MONAI before 1.6.0 Remote Code Execution via algo_from_pickle

MONAI versions before 1.6.0 contain a remote code execution vulnerability in the algofrompickle function due to unsafe pickle.loads deserialization in monai/auto3dseg/utils.py. Attackers can craft malicious pickle files that execute arbitrary system commands when deserialized by the vulnerable...

CVE-2026-100842 MONAI through 1.6.0 _get_fake_spatial_shape eval() Sandbox Bypass via Attribute Chains

MONAI through 1.6.0 contains an eval injection vulnerability in getfakespatialshape in monai/bundle/scripts.py. The function validates shape expressions with a helper that walks the AST and only collects ast.Name nodes, rejecting any name other than 'p' or 'n', before passing the string to eval...

EUVD-2026-87845

MONAI versions before 1.6.0 contain a remote code execution vulnerability in the algofrompickle function due to unsafe pickle.loads deserialization in monai/auto3dseg/utils.py. Attackers can craft malicious pickle files that execute arbitrary system commands when deserialized by the vulnerable...

CVE-2026-100843 MONAI before 1.6.0 Remote Code Execution via algo_from_pickle

MONAI versions before 1.6.0 contain a remote code execution vulnerability in the algofrompickle function due to unsafe pickle.loads deserialization in monai/auto3dseg/utils.py. Attackers can craft malicious pickle files that execute arbitrary system commands when deserialized by the vulnerable...

CVE-2026-100843 MONAI before 1.6.0 Remote Code Execution via algo_from_pickle

MONAI versions before 1.6.0 contain a remote code execution vulnerability in the algofrompickle function due to unsafe pickle.loads deserialization in monai/auto3dseg/utils.py. Attackers can craft malicious pickle files that execute arbitrary system commands when deserialized by the vulnerable...

CVE-2026-100843

The MONAI library (versions before 1.6.0 ) is vulnerable to Remote Code Execution due to an unsafe pickle.loads() deserialization flaw in the algo_from_pickle() function located in monai/auto3dseg/utils.py. An attacker can execute arbitrary system commands by providing a specially crafted malicio...

CVE-2026-100841

The monai pip package (all released versions) contains a Remote Code Execution (RCE) vulnerability in the PersistentDataset component (specifically monai/data/dataset.py). The root cause is the deserialization of malicious pickle files from a shared or world-writable cache_dir (e.g., /tmp/monai_c...

CVE-2026-100841 MONAI through 1.6.0 PersistentDataset Remote Code Execution via Pickle Cache

In MONAI 1.6.0, PersistentDataset monai/data/dataset.py explicitly rejects the combination trackmeta=True with weightsonly=True, forcing users who cache MetaTensors the default tensor type in MONAI = 1.0 to run torch.loadhashfile, weightsonly=False. Related cache helpers in monai/data/utils.py al...

EUVD-2026-87847

In MONAI 1.6.0, PersistentDataset monai/data/dataset.py explicitly rejects the combination trackmeta=True with weightsonly=True, forcing users who cache MetaTensors the default tensor type in MONAI = 1.0 to run torch.loadhashfile, weightsonly=False. Related cache helpers in monai/data/utils.py al...

CVE-2026-100841 MONAI through 1.6.0 PersistentDataset Remote Code Execution via Pickle Cache

In MONAI 1.6.0, PersistentDataset monai/data/dataset.py explicitly rejects the combination trackmeta=True with weightsonly=True, forcing users who cache MetaTensors the default tensor type in MONAI = 1.0 to run torch.loadhashfile, weightsonly=False. Related cache helpers in monai/data/utils.py al...

CVE-2026-100841 MONAI through 1.6.0 PersistentDataset Remote Code Execution via Pickle Cache

In MONAI 1.6.0, PersistentDataset monai/data/dataset.py explicitly rejects the combination trackmeta=True with weightsonly=True, forcing users who cache MetaTensors the default tensor type in MONAI = 1.0 to run torch.loadhashfile, weightsonly=False. Related cache helpers in monai/data/utils.py al...

CVE-2026-100839 Contrast before 1.18.0 AML Injection Remote Code Execution

Contrast is a confidential-computing runtime for Kubernetes. In versions before 1.18.0, the guest kernel's ACPI/AML handling is vulnerable to an AML injection attack "BadAML". ACPI tables containing AML bytecode are passed from the untrusted host QEMU to the guest firmware OVMF and on to the Linu...

CVE-2026-100840

The MONAI library (through version 1.6.0 ) contains a Remote Code Execution vulnerability within its bundle configuration engine . The root cause is that the engine resolves _target_ values to arbitrary importable callables without an allow list and passes $ expressions to Python's eval(). An att...