CVE-2026-100845 PUBLISHED

MONAI before 1.6.0 Remote Code Execution via NumpyReader

Assigner: VulnCheck
Reserved: 27.09.2026 Published: 27.09.2026 Updated: 27.09.2026

MONAI before 1.6.0 contains an unsafe deserialization vulnerability in the NumpyReader class that unconditionally uses numpy.load with allow_pickle=True when loading .npy and .npz files. Attackers can craft malicious .npy files with pickle payloads that execute arbitrary code when loaded through MONAI's standard data pipeline.

Metrics

CVSS Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS Score: 8.5

Product Status

Vendor Project-MONAI
Product MONAI
Versions Default: unaffected
  • affected from 0 to 1.6.0 (excl.)
  • Version 1.6.0 is unaffected

Credits

  • romain-deperne reporter

References

Problem Types

  • Deserialization of Untrusted Data CWE