CVE-2026-100841
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
In MONAI 1.6.0, PersistentDataset explicitly rejects the combination track_meta=True with weights_only=True, forcing users who cache MetaTensors to run torch.load(hashfile, weights_only=False). Related cache helpers also call pickle.loads on cached content and use hashlib.md5 for cache keys. A local user with write access to a shared cache directory can place a malicious pickle file that is deserialized the next time another user's MONAI pipeline reads the cache, resulting in arbitrary code execution in that user's context.
Risk Assessment
A local attacker can execute arbitrary code in another user's context, potentially leading to data theft or privilege escalation.
Recommendation
Update MONAI to a patched version when available. Restrict permissions on cache directories and use secure permissions.
Other vulnerabilities in MONAI
See all- CVE-2026-100846High
MONAI before 1.5.2 contains a deserialization of untrusted data vulnerability in the algo_from_pickle function in monai/auto3dseg/utils.py. The function reads a .pkl file and passes its contents to pickle.loads without validating the data source or content. If an application invokes algo_from_pickle on an attacker-supplied pickle file, an object defining __reduce__ is executed during deserialization, resulting in arbitrary code execution.
- CVE-2026-100845High
MONAI before 1.6.0 contains an unsafe deserialization vulnerability in the NumpyReader class that unconditionally uses numpy.load with allow_pickle=True when loading .npy and .npz files. Attackers can craft malicious .npy files with pickle payloads that execute arbitrary code when loaded through MONAI's standard data pipeline.
- CVE-2026-100844High
MONAI before 1.6.0 is vulnerable to OS command injection in the nnUNetV2Runner component. User-controlled values from the YAML configuration file and CLI/kwargs arguments are concatenated into a command string without quoting or validation and then passed to subprocess with shell=True. If a victim loads a crafted configuration file, arbitrary commands are executed with the privileges of the user running the job.
- CVE-2026-100843High
MONAI versions before 1.6.0 contain a remote code execution vulnerability in the algo_from_pickle() function due to unsafe pickle.loads() deserialization in monai/auto3dseg/utils.py. Attackers can craft malicious pickle files that execute arbitrary system commands when deserialized by the vulnerable function.
- CVE-2026-100842High
MONAI through 1.6.0 contains an eval injection vulnerability in _get_fake_spatial_shape() in monai/bundle/scripts.py. The function validates shape expressions with a helper that walks the AST and only collects ast.Name nodes, rejecting any name other than 'p' or 'n', before passing the string to eval(). Expressions built solely from constants and attribute, subscript, or call nodes contain no ast.Name nodes and bypass the allowlist. An attacker who can influence a bundle's metadata can escape the eval sandbox and achieve code execution.
- CVE-2026-100840High
MONAI through 1.6.0 contains a remote code execution vulnerability in the bundle configuration engine that resolves _target_ values to arbitrary importable callables without an allow list and passes $ expressions to Python eval(). Attackers can publish a malicious bundle with crafted configuration containing arbitrary code that executes when a victim loads the bundle using monai.bundle.load() or monai.bundle.run().
Original NVD description (English source)
In MONAI 1.6.0, PersistentDataset (monai/data/dataset.py) explicitly rejects the combination track_meta=True with weights_only=True, forcing users who cache MetaTensors (the default tensor type in MONAI >= 1.0) to run torch.load(hashfile, weights_only=False). Related cache helpers in monai/data/utils.py also call pickle.loads on cached content and derive cache keys with hashlib.md5. As a result, a local user with write access to a shared or world-writable cache_dir (e.g. /tmp/monai_cache, HPC scratch, ~/.cache/monai) can place a malicious pickle file that is deserialized the next time another user's MONAI pipeline reads the cache, resulting in arbitrary code execution in that user's context. All released versions of the monai pip package are affected; no patched version is available as of the advisory.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS