Repository navigation
Security: Project-MONAI/MONAI
Security Advisories
View known security vulnerabilities and report new vulnerabilities privately to maintainers.
-
RCE via SENet pretrained weights loaded over plaintext HTTP and unpickled without weights_only=TrueGHSA-vm9c-7j6g-c7mm published
Sep 27, 2026 by ericspodHigh -
Arbitrary code execution via unguarded pickle.load of attacker-influenceable postprocessing_file in nnUNetV2RunnerGHSA-8f32-8649-rv87 published
Sep 27, 2026 by ericspodHigh -
Remote code execution on federated-learning clients from a malicious aggregation server (`MonaiAlgo` auto-executes server-provisioned bundle config)GHSA-x6pr-233j-x5cw published
Oct 13, 2026 by garciadiasCritical -
Arbitrary code execution via a bundle's `configs/logging.conf` (`logging.config.fileConfig` eval)GHSA-wvpx-5qmp-46g3 published
Oct 13, 2026 by garciadiasHigh -
Arbitrary code execution in Auto3DSeg `algo_from_json()` via `_target_` class instantiationGHSA-2wx3-8x3w-r8qv published
Oct 15, 2026 by ericspodHigh -
Remote code execution when loading an untrusted MONAI bundle (ConfigParser `_target_` and `$` expression instantiation)GHSA-873f-pvrv-4x83 published
Aug 21, 2026 by ericspodHigh -
PersistentDataset forces weights_only=False with MetaTensor + data/utils.py uses pickle.loads/md5 — local-user pickle RCE via shared cache_dirGHSA-636w-j999-g7x5 published
Aug 21, 2026 by ericspodHigh -
_get_fake_spatial_shape() ast.Name-only allowlist bypassable via Attribute chains — eval sandbox escapeGHSA-h89g-r5pc-wxfm published
Aug 18, 2026 by ericspodHigh -
check_hash() silently passes when hash_val=None; default hash_type='md5' — download chain has no real integrity checkGHSA-hhh4-h52m-fqh6 published
Oct 13, 2026 by garciadiasHigh -
MONAILabel Server Crash and Silent Inference Corruption via Crafted DICOM (pydicom DS/IS Validation Bypass)GHSA-6hp3-vr39-rqw8 published
Oct 13, 2026 by garciadiasCritical