Remote Code Execution in MONAI via Insecure Deserialization of Pretrained Weights

MONAI (Medical Open Network for Artificial Intelligence) versions 0.4.0 through 1.6.0 are vulnerable to remote code execution (CVE-2026-109360). The vulnerability stems from the use of plaintext HTTP to fetch pretrained model weights (specifically for SENet architectures) and the subsequent use of the PyTorch load_state_dict_from_url utility without the weights_only=True parameter.

An on-path attacker capable of intercepting network traffic can replace the legitimate pretrained weight file with a crafted malicious .pth file. When the MONAI library attempts to construct a model using pretrained=True, it triggers the pickle module to deserialize the malicious object, leading to arbitrary code execution within the environment running the MONAI inference or training pipeline. This is particularly relevant for environments that automate model weight downloads from external repositories.

Impact

Successful exploitation allows for arbitrary code execution in the context of the user or service account running the MONAI model pipeline. This could lead to full system compromise, data exfiltration from the research environment, or manipulation of diagnostic medical data. While the vulnerability requires an on-path position, it poses a significant risk to automated research workflows that trust remote weight sources.

Recommendation

1. Upgrade MONAI to version 1.6.1 or later immediately to benefit from hardened weight-loading practices.
2. Implement strict network controls, such as enforcing HTTPS for all model weight downloads, to mitigate the ability of on-path attackers to perform file substitution.
3. Audit Python codebases for instances of load_state_dict_from_url and ensure the weights_only=True parameter is explicitly enabled to prevent the unpickling of arbitrary Python objects.
4. Implement integrity verification (such as SHA-256 hash checks) for all downloaded model weights prior to passing them to model construction utilities.