CVE-2026-100841
Project-monai Monai: unsafe deserialisation can lead to remote code execution
- Risk score
- 47/100
- CVSS
- 7.8 v3.1
- Exploit chance (30 days)
- 0.1%
- Published
- 27 Sep 2026
Open in the live forecast Today's forecast
What to know
- What it is
- In MONAI 1.6.0, PersistentDataset (monai/data/dataset.py) explicitly rejects the combination track_meta=True with weights_only=True, forcing users who cache MetaTensors (the default tensor type in MONAI >= 1.0) to run torch.load(hashfile, weights_only=False). Related cache helpers in monai/data/utils.py also call pick…
- Affected
- Project-monai Monai
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Story map
At a glance
Project-monai Monai: Amber, patch this week. MONAI before 1.5.2 contains a deserialization of untrusted data vulnerability in the algo_from_pickle function in monai/auto3dseg/utils.py. The function reads a .pkl file and passes its contents to pickle.loads without validating the data source or content. If an application invokes algo_from_pickle on an attacker-sup…
The flaws
- CVE-2026-100841: Unsafe deserialisation can lead to remote code execution (CVSS 7.8 · EPSS 0%)
- CVE-2026-100846: Unsafe deserialisation can lead to remote code execution (CVSS 8.8 · EPSS 0%)
- CVE-2026-100844: OS command injection (CVSS 7.8 · EPSS 1%)
- CVE-2026-100842: Remote code execution (CVSS 8.8 · EPSS 0%)
The fix
Upgrade Project-monai Monai: 1.5.2 · 1.6.0 or later on your release line
Who is exposed: Project-monai Monai before 1.5.2
Where it stands
- Public proof of concept
Connects to
- Same weakness: Unsafe deserialisation (CWE-502). 249 other warnings in 30 days
- Same product: Earlier Project-monai Monai warnings. 3 in the last 90 days
Why it is Yellow
- CVSS 7.8 high
References
Original description
In MONAI 1.6.0, PersistentDataset (monai/data/dataset.py) explicitly rejects the combination track_meta=True with weights_only=True, forcing users who cache MetaTensors (the default tensor type in MONAI >= 1.0) to run torch.load(hashfile, weights_only=False). Related cache helpers in monai/data/utils.py also call pickle.loads on cached content and derive cache keys with hashlib.md5. As a result, a local user with write access to a shared or world-writable cache_dir (e.g. /tmp/monai_cache, HPC scratch, ~/.cache/monai) can place a malicious pickle file that is deserialized the next time another user's MONAI pipeline reads the cache, resulting in arbitrary code execution in that user's context. All released versions of the monai pip package are affected; no patched version is available as of the advisory.
Last activity 27 Sep 2026. Patch Forecast updates every hour.