CVE-2026-109360 MONAI 0.4.0 before 1.6.1 RCE via SENet Pretrained Weights Over Plaintext HTTP

MONAI 0.4.0 before 1.6.1 contains a remote code execution vulnerability that allows on-path attackers to execute code by tampering with SENet pretrained weights fetched over plaintext HTTP. Attackers can substitute a crafted .pth file that loadstatedictfromurl unpickles without weightsonly=True,...

PT-2026-110777

Name of the Vulnerable Software and Affected Versions MONAI versions 0.4.0 through 1.6.0 Description An issue exists where on-path attackers can achieve remote code execution by tampering with SENet pretrained weights fetched over plaintext HTTP. This occurs when the load state dict from url...