HIGH8.5

PYSEC-2026-4018

Quick fix

PYSEC-2026-4018 — monai: upgrade to the fixed version with the command below.

pip install --upgrade 'monai>=1.6.0'

Details

MONAI versions before 1.6.0 contain a remote code execution vulnerability in the algo_from_pickle() function due to unsafe pickle.loads() deserialization in monai/auto3dseg/utils.py. Attackers can craft malicious pickle files that execute arbitrary system commands when deserialized by the vulnerable function.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/monai

Introduced in: 0Fixed in: 1.6.0

Fixpip install --upgrade 'monai>=1.6.0'

References

https://www.vulncheck.com/advisories/monai-before-1.6.0-remote-code-execution-via-algo-from-pickle[ADVISORY]
https://github.com/Project-MONAI/MONAI/security/advisories/GHSA-qxq5-qhx6-94qw[EVIDENCE]