Advisory · CVE-2026-100845
MONAI loads booby-trapped data files with pickles enabled
The NumpyReader unconditionally loads .npy and .npz files with allow_pickle=True, so a malicious data file executes code in the data pipeline.
- Vendor
- Project-MONAI
- Product
- MONAI
- Identifier / CWE
- CVE-2026-100845
CWE-502 - Action timing
- Immediate
Explain it like I’m five
MONAI opens every data file with a setting that says 'trust anything inside'. An attacker can hide a command inside a normal-looking data file, and MONAI runs it.
- 01Malicious data file crafted
An attacker crafts a .npy file carrying a pickle payload.
- 02File enters the pipeline
The file reaches MONAI's standard data pipeline from shared storage, a download, or a collaborator.
- 03NumpyReader loads it
The NumpyReader class unconditionally uses numpy.load with allow_pickle=True for .npy and .npz files.
- 04Payload executes
The embedded pickle payload executes arbitrary code in the context of the pipeline.
What happened
MONAI before 1.6.0 (CVE-2026-100845, CVSS 8.5) contains an unsafe deserialization vulnerability in the NumpyReader class, which unconditionally uses numpy.load with allow_pickle=True when loading .npy and .npz files.
Attackers can craft malicious .npy files with pickle payloads that execute arbitrary code when loaded through MONAI’s standard data pipeline. Version 1.6.0 fixes the issue.
What to do
- Upgrade MONAI to 1.6.0 or later.
- Verify the provenance of
.npyand.npzfiles entering pipelines, especially from shared datasets and downloads. - Review data ingestion paths for files that arrive from untrusted sources.
- Investigate hosts that loaded untrusted data files before patching.
Management note
The humble data file is an execution vector when the loader trusts pickles. Dataset hygiene is a security control, not just a data-quality one.