CVE Alert: CVE-2026-100843 – Project-MONAI

MONAI versions before 1.6.0 contain a remote code execution vulnerability in the algo_from_pickle() function due to unsafe pickle.loads() deserialization in monai/auto3dseg/utils.py. Attackers can craft malicious pickle files that execute arbitrary system commands when deserialized by the vulnerable function.

**Risk verdict:** High-impact code-execution risk, but the supplied data does not establish active exploitation or support a priority-one designation.

**Why this matters:** Successful exploitation could compromise the host running the affected workflow, exposing sensitive imaging data and allowing tampering with datasets, models or analysis results. This could disrupt research or clinical operations; exploitation also depends on a malicious serialized artifact reaching a vulnerable processing step. KEV, SSVC, EPSS and PoC indicators were not provided, so current exploitation likelihood remains uncertain.

**Most likely attack path:** An attacker places a crafted pickle file where a user or automated pipeline will process it, for example through a shared dataset, model repository or uploaded artifact. The vector indicates local execution with low complexity and no prior privileges, but user interaction is required; the scope is unchanged, so direct impacts are confined to the vulnerable host rather than automatically extending to other systems.

**Who is most exposed:** Research teams and healthcare organisations using MONAI-based Python workflows, especially shared notebooks, Auto3DSeg pipelines and services that ingest external datasets or model artefacts.

Review Python process logs for unexpected child processes or shell commands during imaging jobs.

Trace use of `algo_from_pickle()` and identify the files and sources it processes.

Hunt for new or modified pickle files in pipeline input, cache and model directories.

Mitigation and prioritisation

Upgrade promptly to the vendor-fixed release; verify dependency locks and deployed environments.

Until patched, block untrusted pickle inputs and restrict artefact sources to verified repositories.

Isolate processing jobs, limit filesystem and network access, and use least-privilege service accounts.

Test representative workflows before rollout; preserve logs and investigate unexpected execution.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.