CVE-2026-100845 in MONAI
Summary
by MITRE • 09/27/2026
MONAI before 1.6.0 contains an unsafe deserialization vulnerability in the NumpyReader class that unconditionally uses numpy.load with allow_pickle=True when loading .npy and .npz files. Attackers can craft malicious .npy files with pickle payloads that execute arbitrary code when loaded through MONAI's standard data pipeline.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/27/2026
The vulnerability identified in versions of the Medical Open Network for AI (MONAI) prior to version 1.6.0 represents a critical security flaw rooted in unsafe deserialization practices within the NumpyReader class. This component is designed to facilitate the loading of medical imaging data stored in NumPy formats, specifically .npy and .npz files, which are common storage mechanisms for array-based datasets used in machine learning pipelines. The core technical deficiency lies in the unconditional invocation of numpy.load with the allow_pickle parameter set to True. By default, this configuration permits the deserialization of arbitrary Python objects embedded within these binary file formats, rather than restricting loading operations strictly to numerical data arrays. This design choice effectively bypasses standard security boundaries that would otherwise prevent the execution of non-data payloads during the ingestion process.
From a technical perspective, NumPy files can contain serialized Python objects using the pickle module when created with specific options or by malicious actors manipulating the file structure. When MONAI processes these files through its data pipeline without validating the content type prior to deserialization, it inadvertently allows an attacker to embed executable code within what appears to be a standard dataset file. Upon loading such a crafted .npy or .npz file, the underlying NumPy library executes the unpickled payload immediately during the initialization of the reader object. This execution occurs before any downstream processing or validation by the application logic, granting remote attackers the ability to run arbitrary commands on the host system with the privileges of the user running the MONAI process.
The operational impact of this vulnerability is severe, as it directly compromises the integrity and confidentiality of systems utilizing MONAI for medical image analysis. An attacker who can supply a malicious dataset file through any input vector that feeds into the NumpyReader class can achieve remote code execution. This could lead to full system compromise, including data exfiltration, installation of persistent backdoors, or lateral movement within internal networks if the affected server is connected to other critical infrastructure. Given that medical AI pipelines often process sensitive patient data and run on high-performance computing clusters, this vulnerability poses a significant risk not only to IT security but also to regulatory compliance regarding patient privacy and data integrity standards such as HIPAA in healthcare environments.
This flaw aligns with CWE-502, which describes Deserialization of Untrusted Data, where an application deserializes untrusted data without sufficiently verifying that the resulting data will be valid. Furthermore, from a threat modeling perspective using the MITRE ATT&CK framework, this vulnerability facilitates initial access and execution tactics commonly associated with supply chain attacks or malicious dataset injection campaigns. Attackers can distribute compromised datasets through public repositories, collaboration platforms, or direct transfer to unsuspecting researchers or organizations relying on MONAI for model training and inference tasks.
To mitigate this risk, it is imperative that users upgrade immediately to version 1.6.0 of MONAI or later, where the NumpyReader has been patched to enforce stricter validation protocols during file loading. In environments where upgrading is not immediately feasible, administrators should implement strict input controls by ensuring that only trusted and verified datasets are processed through the data pipeline. Additionally, deploying network-level security measures such as deep packet inspection for dataset transfers and sandboxing execution environments can provide additional layers of defense against exploitation attempts involving maliciously crafted NumPy files. Regular auditing of third-party libraries and their configurations is essential to maintain a secure posture in machine learning workflows that handle external or untrusted data sources.