{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/monai-0.4.0---1.6.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:monai:monai:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-109360"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["MONAI (0.4.0 - 1.6.0)","MONAI (\u003c 1.6.1)"],"_cs_severities":["high"],"_cs_tags":["vulnerability","rce","deserialization","python","remote-code-execution","monai"],"_cs_type":"advisory","_cs_vendors":["MONAI"],"content_html":"\u003cp\u003eMONAI (Medical Open Network for Artificial Intelligence) versions 0.4.0 through 1.6.0 are vulnerable to remote code execution (CVE-2026-109360). The vulnerability stems from the use of plaintext HTTP to fetch pretrained model weights (specifically for SENet architectures) and the subsequent use of the PyTorch \u003ccode\u003eload_state_dict_from_url\u003c/code\u003e utility without the \u003ccode\u003eweights_only=True\u003c/code\u003e parameter.\u003c/p\u003e\n\u003cp\u003eAn on-path attacker capable of intercepting network traffic can replace the legitimate pretrained weight file with a crafted malicious .pth file. When the MONAI library attempts to construct a model using \u003ccode\u003epretrained=True\u003c/code\u003e, it triggers the \u003ccode\u003epickle\u003c/code\u003e module to deserialize the malicious object, leading to arbitrary code execution within the environment running the MONAI inference or training pipeline. This is particularly relevant for environments that automate model weight downloads from external repositories.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for arbitrary code execution in the context of the user or service account running the MONAI model pipeline. This could lead to full system compromise, data exfiltration from the research environment, or manipulation of diagnostic medical data. While the vulnerability requires an on-path position, it poses a significant risk to automated research workflows that trust remote weight sources.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpgrade MONAI to version 1.6.1 or later immediately to benefit from hardened weight-loading practices.\u003c/li\u003e\n\u003cli\u003eImplement strict network controls, such as enforcing HTTPS for all model weight downloads, to mitigate the ability of on-path attackers to perform file substitution.\u003c/li\u003e\n\u003cli\u003eAudit Python codebases for instances of \u003ccode\u003eload_state_dict_from_url\u003c/code\u003e and ensure the \u003ccode\u003eweights_only=True\u003c/code\u003e parameter is explicitly enabled to prevent the unpickling of arbitrary Python objects.\u003c/li\u003e\n\u003cli\u003eImplement integrity verification (such as SHA-256 hash checks) for all downloaded model weights prior to passing them to model construction utilities.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-10-12T18:38:16Z","date_published":"2026-10-12T18:38:09Z","id":"https://feed.craftedsignal.io/briefs/2026-10-monai-rce/","summary":"MONAI versions prior to 1.6.1 are vulnerable to remote code execution due to insecure deserialization of pretrained weights fetched over plaintext HTTP.","title":"Remote Code Execution in MONAI via Insecure Deserialization of Pretrained Weights","url":"https://feed.craftedsignal.io/briefs/2026-10-monai-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - MONAI (0.4.0 - 1.6.0)","version":"https://jsonfeed.org/version/1.1"}