Remote Code Execution Vulnerability in MONAI by Project MONAI
CVE-2026-100843

8.5HIGH

Key Information:

Vendor

Project-monai

Status
Monai
Vendor
CVE Published:
27 September 2026

What is CVE-2026-100843?

A remote code execution vulnerability exists in MONAI due to the unsafe deserialization method used in the algo_from_pickle() function. By exploiting this vulnerability, attackers can create and deliver malicious pickle files that, when processed by the vulnerable function, can execute arbitrary commands on the host system. This exposure underscores the necessity for users of MONAI to update to the latest version to mitigate the associated risks.

Affected Version(s)

MONAI 0 < 1.6.0

MONAI 1.6.0

References

https://github.com/Project-MONAI/MONAI/security/advisorie...
vendor-advisory
https://www.vulncheck.com/advisories/monai-before-1.6.0-r...
third-party-advisory

CVSS V4

Score:
8.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

aslein1413-sys
.