monai

PyPI · Package

12 reports

Vulnerability alerts

Report	Product	Ecosystem	Severity	Fix status	Last updated
MONAILabel Server Crash and Silent Inference Corruption via Crafted DICOM (pydicom DS/IS Validation Bypass)CVE-2026-48705 · GHSA-6HP3-VR39-RQW8	monai	PyPI	Critical	Fix reported	2026-10-27
MONAI vulnerable to OS command injectionCVE-2026-100844 · GHSA-RGHG-Q7WP-9767Version ranges need review.	monai	PyPI	High	Fix reported	2026-10-01
MONAI: Unsafe functions lead to pickle deserialization rceCVE-2026-100846 · GHSA-89GG-P5R5-Q6R4Version ranges need review.	monai	PyPI	High	Fix reported	2026-10-01
MONAI: Unsafe deserialization in NumpyReader allows arbitrary code execution via malicious .npy filesCVE-2026-100845 · GHSA-WG9G-W2J2-8PGRVersion ranges need review.	monai	PyPI	High	Fix reported	2026-10-01
Incomplete Fix in MONAI: algo_from_pickle() pickle.loads() RCE still present in v1.5.2 despite GHSA-89gg-p5r5-q6r4 claiming patchCVE-2026-100843 · GHSA-QXQ5-QHX6-94QWVersion ranges need review.	monai	PyPI	High	Fix reported	2026-10-01
PYSEC-2026-4015CVE-2026-100840 · GHSA-873F-PVRV-4X83	monai	PyPI	High	Fix reported	2026-10-01
PYSEC-2026-4016CVE-2026-100841 · GHSA-636W-J999-G7X5	monai	PyPI	High	No fix reported	2026-10-01
PYSEC-2026-4017CVE-2026-100842 · GHSA-H89G-R5PC-WXFM	monai	PyPI	High	Fix reported	2026-10-01
MONAI has Path Traversal (Zip Slip) in NGC Private Bundle DownloadCVE-2026-21851 · GHSA-9RG3-9PVR-6P27Version ranges need review.	monai	PyPI	Medium	Fix reported	2026-07-07
MONAI does not prevent path traversal, potentially leading to arbitrary file writesCVE-2025-58755 · GHSA-X6WW-PF9M-M73MVersion ranges need review.	monai	PyPI	High	Fix reported	2026-06-06
Monai: Unsafe use of Pickle deserialization may lead to RCECVE-2025-58757 · GHSA-P8CM-MM2V-GWJMVersion ranges need review.	monai	PyPI	High	Fix reported	2026-06-06
MONAI: Unsafe torch usage may lead to arbitrary code executionCVE-2025-58756 · GHSA-6VM5-6JV9-RJPJVersion ranges need review.	monai	PyPI	High	Fix reported	2026-06-06