Advisory · CVE-2026-100846
Older MONAI runs attacker code from algorithm pickles
In MONAI before 1.5.2, algo_from_pickle passes attacker-supplied pickle files straight to pickle.loads, executing arbitrary code in the application.
- Vendor
- Project-MONAI
- Product
- MONAI
- Identifier / CWE
- CVE-2026-100846
CWE-502 - Action timing
- Immediate
Explain it like I’m five
An old MONAI will run whatever instructions are sealed inside a file someone hands it. Hand it a rigged file and your machine follows the attacker's instructions.
- 01Attacker pickle supplied
An attacker crafts a .pkl file with an object defining __reduce__.
- 02Application calls the function
The application invokes algo_from_pickle on the attacker-supplied pickle file.
- 03Contents pass through
The function reads the file and passes its contents to pickle.loads without validating the data source or content.
- 04Code executes
The __reduce__ method executes during deserialization, running arbitrary code in the application's context.
What happened
MONAI before 1.5.2 (CVE-2026-100846, CVSS 8.8) contains a deserialization-of-untrusted-data vulnerability in the algo_from_pickle function in monai/auto3dseg/utils.py. The function reads a .pkl file and passes its contents to pickle.loads without validating the data source or content.
If an application invokes algo_from_pickle on an attacker-supplied pickle file, an object defining __reduce__ is executed during deserialization, resulting in arbitrary code execution in the context of the application. Version 1.5.2 fixes the issue.
What to do
- Upgrade MONAI to 1.5.2 or later.
- Audit auto3dseg workflows for pickle inputs that originate outside your control.
- Investigate environments that may have processed untrusted algorithm pickles.
Management note
Same vulnerable function family as the newer CVE-2026-100843, but this one predates 1.5.2. If you skipped upgrades for a while, this is the one that punishes it.