CVE Alert: CVE-2026-100845 – Project-MONAI

MONAI before 1.6.0 contains an unsafe deserialization vulnerability in the NumpyReader class that unconditionally uses numpy.load with allow_pickle=True when loading .npy and .npz files. Attackers can craft malicious .npy files with pickle payloads that execute arbitrary code when loaded through MONAI’s standard data pipeline.

This is a high-impact code-execution risk for environments that automatically process untrusted NumPy files; investigate promptly, although no active-exploitation status is provided.

Successful exploitation could let an attacker run code with the data-processing process’s permissions, potentially exposing research data, credentials or model assets, or disrupting training and inference. KEV, SSVC, PoC and EPSS data were not supplied, so observed exploitation and likelihood cannot be assessed; those signals are needed to refine urgency.

### Most likely attack path

An attacker places a crafted file where it will be consumed, or persuades someone to include it in a dataset; the vulnerable reader then processes it in the normal pipeline. The local attack vector and user interaction requirement mean the file must reach a processing host and be loaded, but no prior privileges or complex conditions are indicated. Scope is unchanged, so direct impact is confined to the affected process’s security context, though accessible host resources may be exposed.

### Who is most exposed

Research, clinical AI and machine-learning teams using shared datasets, automated ingestion, notebooks, or training and inference pipelines are most exposed—especially where external files are accepted without review.

Identify use of the affected reader in ingestion and processing jobs.

Alert on unexpected `.npy` or `.npz` files entering watched dataset locations.

Review job logs and process telemetry for unusual child processes or outbound connections during file loading.

Check for unexpected changes to datasets, model files, or job credentials.

### Mitigation and prioritisation

Upgrade to the vendor’s fixed release; verify dependency resolution across deployed environments.

Until upgraded, disable the unsafe loading path or reject untrusted files before processing.

Restrict ingestion to trusted sources and run processing jobs with minimal permissions and isolated storage.

Test representative pipelines before rollout; document exceptions and schedule prompt change approval.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.