TI-2026-64983 Aliases CVE-2026-100845 GHSA-4jj3-3266-2688

MONAI before 1.6.0 Remote Code Execution via NumpyReader

HIGH 72CWE-502Published 2026-09-27 · Updated 2026-09-28

Key facts

Attack vector: Local
Privileges required: None
User interaction: Passive
Attack complexity: Low
Attack requirements: None
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-502.

Summary

MONAI before 1.6.0 contains an unsafe deserialization vulnerability in the NumpyReader class that unconditionally uses numpy.load with allow_pickle=True when loading .npy and .npz files. Attackers can craft malicious .npy files with pickle payloads that execute arbitrary code when loaded through MONAI's standard data pipeline.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00203 10th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed MONAI (Project-MONAI): 1.6.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Project-MONAI	MONAI	before 1.6.0	1.6.0	Patch available	CNA

MONAI VendorProject-MONAI Affected before 1.6.0 Fixed in 1.6.0 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:project-monai:monai::::::::	before 1.6.0	Vulnerable	Project-MONAI

cpe:2.3:a:project-monai:monai:*:*:*:*:*:*:*:* Versions before 1.6.0 Vulnerable ·Project-MONAI

Remediation

Fix · CNA MONAI (Project-MONAI) Fixed in 1.6.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-09-27
Project-MONAI MONAI 1.6.0
3 records Highest priority Priority HIGH 3 HIGH
Other records, highest priority first
- TI-2026-64982 MONAI before 1.6.0 OS Command Injection via dataset_name_or_idPriority HIGH 72
- TI-2026-64981 MONAI before 1.6.0 Remote Code Execution via algo_from_picklePriority HIGH 72
Show all 3 records →

Timeline

2026-10-02 Threatist record created from CVE-2026-100845
2026-10-03 Alias added: GHSA-4jj3-3266-2688

References

Exploit 1

GitHub Security Advisory (GHSA-wg9g-w2j2-8pgr)

TI-2026-64984 MONAI before 1.5.2 Remote Code Execution via Pickle Deserialization CVSS 4.0HIGH 8.8
TI-2026-64982 MONAI before 1.6.0 OS Command Injection via dataset_name_or_id CVSS 4.0HIGH 8.6
TI-2026-64981 MONAI before 1.6.0 Remote Code Execution via algo_from_pickle CVSS 4.0HIGH 8.5
TI-2026-64978 MONAI through 1.6.0 Remote Code Execution via bundle configuration CVSS 4.0HIGH 8.5
TI-2026-64980 MONAI through 1.6.0 _get_fake_spatial_shape eval() Sandbox Bypass via Attribute Chains CVSS 4.0HIGH 7.3
TI-2026-17553 MONAI has Path Traversal (Zip Slip) in NGC Private Bundle Download CVSS 3.1MEDIUM 5.3

See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences