{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/actors/nvidia/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":["NVIDIA"],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["MONAI (1.6.0)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"threat","_cs_vendors":["NVIDIA"],"content_html":"\u003cp\u003eThe \u003ccode\u003eNumpyReader\u003c/code\u003e class in the MONAI medical imaging framework (specifically \u003ccode\u003emonai/data/image_reader.py\u003c/code\u003e) contains a critical security flaw where \u003ccode\u003enumpy.load\u003c/code\u003e is invoked with \u003ccode\u003eallow_pickle=True\u003c/code\u003e. This parameter is hardcoded and cannot be overridden by end users via keyword arguments. Because the \u003ccode\u003eLoadImage\u003c/code\u003e transform automatically selects \u003ccode\u003eNumpyReader\u003c/code\u003e for all \u003ccode\u003e.npy\u003c/code\u003e and \u003ccode\u003e.npz\u003c/code\u003e files, any automated data pipeline or dataset processing workflow - including \u003ccode\u003ePersistentDataset\u003c/code\u003e or \u003ccode\u003eCacheDataset\u003c/code\u003e - becomes a vector for arbitrary code execution. The vulnerability stems from Python's pickle protocol, which can be leveraged to execute arbitrary code during the deserialization of untrusted objects within a data file. This vulnerability affects all MONAI versions prior to 1.6.0.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker creates a malicious serialized Python object using the \u003ccode\u003e__reduce__\u003c/code\u003e method to define the payload (e.g., \u003ccode\u003eos.system\u003c/code\u003e commands).\u003c/li\u003e\n\u003cli\u003eAttacker writes this object to a \u003ccode\u003e.npy\u003c/code\u003e or \u003ccode\u003e.npz\u003c/code\u003e file using \u003ccode\u003enp.save\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eAttacker poisons a shared research dataset or contributes the malicious file to a public repository, tutorial, or MONAI bundle.\u003c/li\u003e\n\u003cli\u003eVictim downloads or maps the malicious dataset to their local environment or server.\u003c/li\u003e\n\u003cli\u003eVictim initiates a MONAI data pipeline (e.g., training loop or inference script) that invokes \u003ccode\u003eLoadImage\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eLoadImage\u003c/code\u003e identifies the file extension and triggers \u003ccode\u003eNumpyReader.read()\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eNumpyReader\u003c/code\u003e calls \u003ccode\u003enp.load(filename, allow_pickle=True)\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003ePython deserializes the malicious payload, resulting in execution of attacker-supplied code within the process context.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in arbitrary code execution on the server or workstation processing the medical data. This poses significant risks in clinical and research environments, potentially leading to unauthorized access to protected health information (PHI), lateral movement within institutional networks, and compromise of high-performance computing clusters used for medical image analysis.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritize immediate remediation and containment:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the MONAI library to version 1.6.0 or higher immediately.\u003c/li\u003e\n\u003cli\u003eAudit all data pipelines and research environments for untrusted \u003ccode\u003e.npy\u003c/code\u003e or \u003ccode\u003e.npz\u003c/code\u003e file sources.\u003c/li\u003e\n\u003cli\u003eIsolate high-performance computing environments where shared datasets are processed from sensitive network segments until updates are verified.\u003c/li\u003e\n\u003cli\u003eRestrict filesystem access to dataset directories to prevent unauthorized modification by low-privileged users or external contributors.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-18T20:57:21Z","date_published":"2026-08-18T20:57:21Z","id":"https://feed.craftedsignal.io/briefs/2026-08-monai-rce/","summary":"The MONAI library contains a hardcoded insecure deserialization vulnerability in NumpyReader, allowing arbitrary code execution when processing malicious .npy or .npz files.","title":"Arbitrary Code Execution in MONAI NumpyReader","url":"https://feed.craftedsignal.io/briefs/2026-08-monai-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - NVIDIA","version":"https://jsonfeed.org/version/1.1"}