Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
9 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
An unauthenticated remote attacker can crash a running MONAILabel server or silently corrupt its medical AI inference results by uploading a single crafted DICOM file (~132 KB) via the REST API. The vulnerability stems from pydicom's lack of validation for Decimal String (DS) and Integer String (IS) DICOM Value Representations, which allows NaN and infinity values to pass through MONAI's PydicomReader and propagate through the entire spatial transform and ML inference pipeline. No authentication is required for the default MONAILabel REST API. The attacker needs only network access to the server (default port 8000). Severity: CVSS 3.1: 8.7 HIGH CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:L CWE: CWE-20 (Improper Input Validation) → CWE-682 (Incorrect Calculation) Details Root Cause — Layer 1: pydicom accepts invalid VR values pydicom's `DSfloat.new()` calls Python's `float(val)`, which silently accepts "NaN", "inf", and "-inf". The DICOM…
Recommended action: Upgrade to 1.6.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The NumpyReader class in monai/data/imagereader.py unconditionally uses np.load(name, allowpickle=True) (line 1276), enabling arbitrary code execution when loading a crafted .npy or .npz file. This affects all MONAI versions up to and including the latest commit (5b71547). The allowpickle parameter is hardcoded to True and cannot be overridden by the user (the docstring explicitly states kwargs are accepted "except allowpickle"). Details Vulnerable code (permalink): The NumpyReader is automatically selected by MONAI's LoadImage transform for any file with .npy or .npz extension (see monai/transforms/io/array.py line 68: "numpyreader": NumpyReader). This means the entire standard data pipeline (LoadImage, PersistentDataset, CacheDataset, SmartCacheDataset, etc.) is vulnerable. The allowpickle=True parameter enables Python's pickle protocol during numpy loading. Pickle is known to be unsafe for untrusted data, as it can execute arbitrary code during deserialization via the…
Recommended action: Upgrade to 1.6.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Comment from JPCERT/CC We are submitting the report again as we have yet to receive any responses from you after submitting it on February 5 and March 11. It would be greatly appreciated if you could send us a message after confirming it so that we can follow up the case by email. Summary MONAI vulnerable to OS command injection. Details This library concatenates user-controlled values (YAML's "datasetnameorid" or part of "CLI/kwargs") without quoting or validation. Since this string is passed to subprocess with shell=True, shell metacharacters (e.g., Windows: & / Linux: ;) are interpreted. As a result, arbitrary commands can be concatenated and executed. Therefore, the reporter identifies this as CWE-78 (OS Command Injection). The victim needs to load a crafted YAML file in the code that launches training/validation jobs based on the configuration (YAML/arguments). There are no other constraints. PoC Verified on Windows. Load a modified YAML file with crafted "datasetnameorid" as…
Recommended action: Upgrade to 1.6.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
GHSA-89gg-p5r5-q6r4 claims the pickle deserialization vulnerability in algofrompickle() was fixed in v1.5.2. However, monai/auto3dseg/utils.py has not been modified since 2024-07-12 — 18 months before v1.5.2 was released (2026-01-29). All three pickle.loads() calls remain unchanged. The fix was never implemented. Vulnerable Code File: monai/auto3dseg/utils.py (last commit: 2024-07-12, unchanged in v1.5.2) python def algofrompickle(pklfilename: str, ...): with open(pklfilename, "rb") as fpi: databytes = fpi.read() data = pickle.loads(databytes) SINK 1 — line 321, RCE fires here isinstance/key checks happen AFTER deserialization — already too late algobytes = data.pop("algobytes") ... if len(templatepathscandidates) == 0: algo = pickle.loads(algobytes) SINK 2 — line 350 else: for p in templatepathscandidates: algo = pickle.loads(algobytes) SINK 3 — line 356 No Unpickler subclass, no findclass restriction, no allowlist. Why the Fix is Incomplete -…
Recommended action: Upgrade to 1.6.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The algofrompickle function in monai/auto3dseg/utils.py causes pickle.loads(databytes) to be executed, and it does not perform any validation on the input parameters. This ultimately leads to insecure deserialization and can result in code execution vulnerabilities. Details poc Generate the malicious file "attackalgo.pkl" through POC. Ultimately, it will trigger pickle.load through a file to identify the command execution. <img width="909" height="534" alt="image" src="https://github.com/user-attachments/assets/071adbb7-3e40-4651-be48-abd2ce32470f" / Causes of the vulnerability: Impact Arbitrary code execution Repair suggestions Verify the data source and content before deserializing, or use a safe deserialization method
Recommended action: Upgrade to 1.6.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A Path Traversal (Zip Slip) vulnerability exists in MONAI's downloadfromngcprivate() function. The function uses zipfile.ZipFile.extractall() without path validation, while other similar download functions in the same codebase properly use the existing safeextractmember() function. This appears to be an implementation oversight, as safe extraction is already implemented and used elsewhere in MONAI. CWE: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) --- Details Vulnerable Code Location File: monai/bundle/scripts.py Lines: 291-292 Function: downloadfromngcprivate() Root Cause The code calls z.extractall(extractpath) directly without validating that archive member paths stay within the extraction directory. Safe Code Already Exists MONAI already has a safe extraction function in monai/apps/utils.py (lines 125-154) that properly validates paths: Comparison with Other Download Functions | Function | File | Uses Safe Extraction? |…
Recommended action: Upgrade to 1.5.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
To prevent this report from being deemed inapplicable or out of scope, due to the project's unique nature (for medical applications) and widespread popularity (6k+ stars), it's important to pay attention to some of the project's inherent security issues. (This is because medical professionals may not pay enough attention to security issues when using this project, leading to attacks on services or local machines.) Summary The function in automatically handles dictionary key-value pairs ending with a specific suffix and deserializes them using pickle.loads() . This function also lacks any security measures. When verified using the following proof-of-concept, arbitrary code execution can occur. Before running the command, there was no hacker1.txt content in my /tmp directory, but after running the command, the command was executed, indicating that the attack was successful. The above proof-of-concept is merely a validation of the vulnerability. The attacker creates malicious dataset…
Recommended action: Upgrade to 1.5.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In in monai/bundle/scripts.py , is loaded securely. However, insecure loading methods still exist elsewhere in the project, such as when loading checkpoints. This is a common practice when users want to reduce training time and costs by loading pre-trained models downloaded from platforms like huggingface. Loading a checkpoint containing malicious content can trigger a deserialization vulnerability, leading to code execution. The following proof-of-concept demonstrates the issues that arise when loading insecure checkpoints. Because my test environment is missing some content, an error will be reported during operation, but the operation is still executed. Impact Leading to arbitrary command execution Fix suggestion Use a safe method to load, or force weightsonly=True
Recommended action: Upgrade to 1.5.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The extractall function is used directly to process compressed files. It is used in many places in the project. When the Zip file containing malicious content is decompressed, it will overwrite the system files. In addition, the project allows the download of the zip content through the link, which increases the scope of exploitation of this vulnerability. When reproducing locally, follow the process below to create a malicious zip file and simulate the process of remotely downloading the zip file. Then start the http service through python Another terminal simulates a normal user downloading zip content from the Internet, perhaps from some popular forums or blogs, such as huggingface, etc. We can see that malicious.txt was indeed extracted to the root directory, demonstrating that the path traversal successfully wrote the malicious file. If the Zip file contains SSH keys, malicious content that automatically loads when the user boots the computer, or overwrites legitimate…
Recommended action: Upgrade to 1.5.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.