TI-2026-71177 Aliases CVE-2026-109361 GHSA-7hmf-j253-4p2j

Insecure deserialization in MONAI nnUNetV2Runner allows code execution

LOW 32CWE-502Published 2026-10-12 · Updated 2026-10-26

Key facts

Attack vector: Local
Privileges required: Low
User interaction: Passive
Attack complexity: Low
Attack requirements: None
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-502.

Summary

MONAI from 1.2.0 before 1.6.1 contains an insecure deserialization flaw in nnUNetV2Runner, which unpickles the postprocessing_file path read from inference_information.json without confining it to the results directory (CWE-502). An attacker who can modify inference_information.json can point it at a malicious pickle elsewhere on the filesystem, executing code when predict_ensemble_postprocessing runs. The attack requires local access with low privileges and user interaction, and the CVSS 4.0 base score is 7.0 (HIGH).

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

MONAI 1.2.0 before 1.6.1 contains an insecure deserialization vulnerability in nnUNetV2Runner that unpickles the postprocessing_file path read from inference_information.json without confining it to the results directory. Attackers who can modify inference_information.json can point it at a malicious pickle elsewhere on the filesystem to execute code when predict_ensemble_postprocessing runs.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00234 14th percentileScored 2026-11-07

Fix Fixed MONAI (Project-MONAI): 1.6.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Project-MONAI	MONAI	1.2.0 to before 1.6.1	1.6.1	Patch available	CNA

MONAI VendorProject-MONAI Affected 1.2.0 to before 1.6.1 Fixed in 1.6.1 Patch available CNA

Remediation

Upgrade MONAI to version 1.6.1 or later, which fixes the flaw.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Fix · CNA MONAI (Project-MONAI) Fixed in 1.6.1

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-10-12
Project-MONAI MONAI 1.6.1
2 records Highest priority Priority HIGH 1 HIGH, 1 LOW
Other records, highest priority first
- TI-2026-71176 MONAI RCE via unsafe SENet pretrained weight loading over plaintext HTTPPriority HIGH 69
Show all 2 records →

Timeline

2026-10-12 Threatist record created from CVE-2026-109361
2026-10-12 Alias added: GHSA-7hmf-j253-4p2j
2026-10-13 Priority changed: MEDIUM → LOW
2026-10-26 CISA SSVC decision points changed

References

Patch 1

Patch Commit

Advisory 1

GitHub Security Advisory (GHSA-8f32-8649-rv87)

TI-2026-85662 MONAI accepts non-finite DICOM geometry values, corrupting inference CVSS 3.1CRITICAL 9.3
TI-2026-64984 MONAI before 1.5.2 Remote Code Execution via Pickle Deserialization CVSS 4.0HIGH 8.8
TI-2025-36415 MONAI's unsafe use of Pickle deserialization may lead to RCE CVSS 3.1HIGH 8.8
TI-2026-83080 Remote code execution in MONAI Auto3DSeg algo_from_json() CVSS 4.0HIGH 8.5
TI-2026-64983 MONAI before 1.6.0 Remote Code Execution via NumpyReader CVSS 4.0HIGH 8.5
TI-2026-64982 MONAI before 1.6.0 OS Command Injection via dataset_name_or_id CVSS 4.0HIGH 8.6

See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences