WS-2026-0032

The NumpyReader class in monai/data/imagereader.py unconditionally calls np.loadname, allowpickle=True, enabling arbitrary code execution when loading a crafted .npy or .npz file. The allowpickle parameter was hardcoded to True and could not be overridden by the caller, and NumpyReader is selecte...