TI-2026-64979 Aliases CVE-2026-100841 GHSA-wfpp-6gx5-h8xr

MONAI through 1.6.0 PersistentDataset Remote Code Execution via Pickle Cache

LOW 38CWE-502Published 2026-09-27 · Updated 2026-09-28

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-502.

Summary

In MONAI 1.6.0, PersistentDataset (monai/data/dataset.py) explicitly rejects the combination track_meta=True with weights_only=True, forcing users who cache MetaTensors (the default tensor type in MONAI >= 1.0) to run torch.load(hashfile, weights_only=False). Related cache helpers in monai/data/utils.py also call pickle.loads on cached content and derive cache keys with hashlib.md5. As a result, a local user with write access to a shared or world-writable cache_dir (e.g. /tmp/monai_cache, HPC scratch, ~/.cache/monai) can place a malicious pickle file that is deserialized the next time another user's MONAI pipeline reads the cache, resulting in arbitrary code execution in that user's context. All released versions of the monai pip package are affected; no patched version is available as of the advisory.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00128 2nd percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Project-MONAI	MONAI	up to 1.6.0	—	No fix listed	CNA

MONAI VendorProject-MONAI Affected up to 1.6.0 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:project-monai:monai:1.6.0:-::::::	1.6.0	Vulnerable	Project-MONAI

cpe:2.3:a:project-monai:monai:1.6.0:-:*:*:*:*:*:* Versions 1.6.0 Vulnerable ·Project-MONAI

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2026-100841
2026-10-03 Alias added: GHSA-wfpp-6gx5-h8xr

References

Advisory 1

GitHub Security Advisory (GHSA-636w-j999-g7x5)

TI-2026-64984 MONAI before 1.5.2 Remote Code Execution via Pickle Deserialization CVSS 4.0HIGH 8.8
TI-2026-64983 MONAI before 1.6.0 Remote Code Execution via NumpyReader CVSS 4.0HIGH 8.5
TI-2026-64982 MONAI before 1.6.0 OS Command Injection via dataset_name_or_id CVSS 4.0HIGH 8.6
TI-2026-64981 MONAI before 1.6.0 Remote Code Execution via algo_from_pickle CVSS 4.0HIGH 8.5
TI-2026-64978 MONAI through 1.6.0 Remote Code Execution via bundle configuration CVSS 4.0HIGH 8.5
TI-2026-64980 MONAI through 1.6.0 _get_fake_spatial_shape eval() Sandbox Bypass via Attribute Chains CVSS 4.0HIGH 7.3

See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences