Project-Monai Monai
11 CVEs affecting Project-Monai Monai. Latest disclosed: 2026-09-27. Critical: 0, High: 10.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-58757 | High | 8.8 | 2025-09-09 | MONAI (Medical Open Network for AI) is an AI toolkit for health care imaging. In versions up to and including 1.5.0, the `pickle_operations` function in `monai… |
CVE-2025-58756 | High | 8.8 | 2025-09-09 | MONAI (Medical Open Network for AI) is an AI toolkit for health care imaging. In versions up to and including 1.5.0, in `model_dict = torch.load(full_path, map… |
CVE-2025-58755 | High | 8.8 | 2025-09-09 | MONAI (Medical Open Network for AI) is an AI toolkit for health care imaging. The extractall function `zip_file.extractall(output_dir)` is used directly to pro… |
CVE-2026-100844 | High | 8.4 | 2026-09-27 | MONAI before 1.6.0 is vulnerable to OS command injection in the nnUNetV2Runner component (monai.apps.nnunet.nnunetv2_runner). User-controlled values taken from… |
CVE-2026-100845 | High | 7.8 | 2026-09-27 | MONAI before 1.6.0 contains an unsafe deserialization vulnerability in the NumpyReader class that unconditionally uses numpy.load with allow_pickle=True when l… |
CVE-2026-100843 | High | 7.8 | 2026-09-27 | MONAI versions before 1.6.0 contain a remote code execution vulnerability in the algo_from_pickle() function due to unsafe pickle.loads() deserialization in mo… |
CVE-2026-100841 | High | 7.8 | 2026-09-27 | In MONAI 1.6.0, PersistentDataset (monai/data/dataset.py) explicitly rejects the combination track_meta=True with weights_only=True, forcing users who cache Me… |
CVE-2026-100840 | High | 7.8 | 2026-09-27 | MONAI through 1.6.0 contains a remote code execution vulnerability in the bundle configuration engine that resolves _target_ values to arbitrary importable cal… |
CVE-2026-100846 | High | 7.6 | 2026-09-27 | MONAI before 1.5.2 contains a deserialization of untrusted data vulnerability in the algo_from_pickle function in monai/auto3dseg/utils.py. The function reads… |
CVE-2026-100842 | High | 7.0 | 2026-09-27 | MONAI through 1.6.0 contains an eval injection vulnerability in _get_fake_spatial_shape() in monai/bundle/scripts.py. The function validates shape expressions… |
CVE-2026-21851 | Medium | 5.3 | 2026-01-07 | MONAI (Medical Open Network for AI) is an AI toolkit for health care imaging. In versions up to and including 1.5.1, a Path Traversal (Zip Slip) vulnerability… |