CVE-2026-109361 in MONAI
Summary
by MITRE • 10/12/2026
MONAI 1.2.0 before 1.6.1 contains an insecure deserialization vulnerability in nnUNetV2Runner that unpickles the postprocessing_file path read from inference_information.json without confining it to the results directory. Attackers who can modify inference_information.json can point it at a malicious pickle elsewhere on the filesystem to execute code when predict_ensemble_postprocessing runs.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/12/2026
The vulnerability identified in MONAI versions prior to 1.6.1 represents a critical insecure deserialization flaw within the nnUNetV2Runner component, specifically affecting how post-processing files are handled during inference operations. This security issue stems from the application's failure to validate or constrain file paths before processing them through Python’s pickle module. When MONAI executes ensemble predictions, it relies on an inference_information.json configuration file that specifies various parameters for the model execution pipeline. Among these parameters is a path pointing to a postprocessing_file intended to be applied after the initial prediction results are generated. The core technical flaw lies in the fact that this path is read directly from the JSON input without any sanitization or restriction, allowing it to reference arbitrary locations on the host filesystem rather than being confined strictly to the designated results directory where safe output files should reside.
From a technical perspective, Python’s pickle module is inherently unsafe for deserializing untrusted data because it can instantiate arbitrary objects and execute code during the unpickling process. By accepting an unrestricted file path from inference_information.json, the application enables attackers who have write access to this configuration file to inject a reference to a maliciously crafted pickle file located elsewhere on the system. When the predict_ensemble_postprocessing function is invoked, it attempts to load and execute the contents of the specified postprocessing_file. If an attacker has previously placed a malicious pickle payload at that location, the unpickling operation will trigger arbitrary code execution with the privileges of the user running the MONAI service or application. This mechanism effectively bypasses any sandboxing or isolation intended by limiting output to specific directories, as the input validation step is entirely missing for this critical configuration parameter.
The operational impact of this vulnerability is severe, particularly in environments where model inference pipelines are automated and configurations may be generated dynamically or managed by multiple users with varying levels of trust. An attacker who can modify the inference_information.json file could achieve remote code execution on the host machine without needing to interact directly with the application’s input interfaces for data samples. This scenario is plausible in collaborative research environments, cloud-based medical imaging platforms, or CI/CD pipelines where configuration files are frequently updated and may not be subject to strict integrity checks. The ability to execute arbitrary code means that an attacker could potentially exfiltrate sensitive patient data stored on the system, install backdoors for persistent access, pivot to other systems within the network, or disrupt critical healthcare infrastructure services dependent on accurate medical image analysis.
This vulnerability aligns with CWE-502, which describes deserialization of untrusted data as a common weakness leading to remote code execution. Furthermore, it maps to MITRE ATT&CK technique T1059, specifically Command and Scripting Interpreter sub-techniques such as Python (T1059.006), where attackers use scripting languages to execute commands on compromised systems. The attack vector also relates to CWE-22, Improper Limitation of a Pathname to a Restricted Directory, because the application fails to restrict file access to the expected safe directory, allowing traversal or direct reference to arbitrary paths. To mitigate this risk, organizations must upgrade MONAI to version 1.6.1 or later where these input validation constraints have been implemented. In cases where immediate upgrading is not feasible, administrators should enforce strict filesystem permissions on inference_information.json and any associated postprocessing files to prevent unauthorized modification. Additionally, implementing a whitelist approach for allowed file paths in configuration files and avoiding the use of pickle for untrusted data sources are essential defensive measures to prevent similar deserialization attacks in other components of the software stack.