Advisory · CVE-2026-100843
MONAI auto-segmentation loads attack pickles on demand
The algo_from_pickle function in MONAI's auto3dseg module runs pickle.loads() on attacker-supplied files, executing arbitrary system commands.
- Vendor
- Project-MONAI
- Product
- MONAI
- Identifier / CWE
- CVE-2026-100843
CWE-502 - Action timing
- Immediate
Explain it like I’m five
MONAI will open any sealed package someone hands it and follow the instructions inside. A package from an attacker can contain instructions to take over your machine.
- 01Malicious pickle supplied
An attacker crafts a pickle file that executes arbitrary system commands when deserialized.
- 02algo_from_pickle called
An application invokes algo_from_pickle() on the attacker-supplied file.
- 03Unsafe deserialization
The function in monai/auto3dseg/utils.py passes the file contents to pickle.loads() with no validation of source or content.
- 04Arbitrary code execution
The embedded payload executes with the privileges of the user running the application.
What happened
MONAI versions before 1.6.0 (CVE-2026-100843, CVSS 8.5) contain a remote code execution vulnerability in the algo_from_pickle() function in monai/auto3dseg/utils.py. The function performs unsafe pickle.loads() deserialization without validating the data source or content.
Attackers can craft malicious pickle files that execute arbitrary system commands when deserialized by the vulnerable function. Version 1.6.0 fixes the issue.
What to do
- Upgrade MONAI to 1.6.0 or later.
- Only feed algorithm pickle files from trusted, verified sources into auto3dseg workflows.
- Review pipelines for places where pickles arrive from external or shared storage.
- Investigate hosts that may have deserialized untrusted pickles.
Management note
Pickle deserialization is a perennial RCE primitive in ML tooling. The fix is the version bump; the durable fix is treating every pickle as executable code at the pipeline-design level.