CVE-2026-100846: Project-Monai Monai

High severity, CVSS 8.8. EPSS: 0.3% chance of exploitation in the next 30 days.

MONAI before 1.5.2 contains a deserialization of untrusted data vulnerability in the algo_from_pickle function in monai/auto3dseg/utils.py. The function reads a .pkl file and passes its contents to pickle.loads without validating the data source or content. If an application invokes algo_from_pickle on an attacker-supplied pickle file, an object defining __reduce__ is executed during deserialization, resulting in arbitrary code execution in the context of the application.

Affected products

• Project-Monai Monai: before 1.5.2 (fixed in 1.5.2)

Published 2026-09-27. Last modified 2026-10-08.