Remote Code Execution in MONAI 1.6.0 Due to PersistentDataset Misconfiguration

CVE-2026-100841

What is CVE-2026-100841?

In MONAI version 1.6.0, a vulnerability exists within the PersistentDataset component, which improperly handles cache files. Specifically, the configuration of parameters track_meta=True and weights_only=True is incorrectly restricted, resulting in users being forced to utilize torch.load with weights_only=False for caching MetaTensors. This issue extends to related cache utility functions that utilize pickle for deserializing cached content. A local user with write access to shared or world-writable cache directories can introduce a malicious pickle file. The next time another user's MONAI pipeline accesses the cache, this could lead to arbitrary code execution within that user's environment. Currently, all released versions of the MONAI pip package are susceptible, and no patched version is available addressing this concern.

References