Security advisories

high2026-08-18

MONAI: Unsafe deserialization in NumpyReader allows arbitrary code execution via malicious .npy files

GHSA-wg9g-w2j2-8pgr

high2026-08-18

MONAI vulnerable to OS command injection

GHSA-rghg-q7wp-9767

high2026-08-18

Incomplete Fix in MONAI: algo_from_pickle() pickle.loads() RCE still present in v1.5.2 despite GHSA-89gg-p5r5-q6r4 claiming patch

GHSA-qxq5-qhx6-94qw

high2026-04-07

MONAI: Unsafe functions lead to pickle deserialization rce

GHSA-89gg-p5r5-q6r4

medium2026-01-06

MONAI has Path Traversal (Zip Slip) in NGC Private Bundle Download

GHSA-9rg3-9pvr-6p27 · CVE-2026-21851

high2025-09-09

Monai: Unsafe use of Pickle deserialization may lead to RCE

GHSA-p8cm-mm2v-gwjm · CVE-2025-58757

high2025-09-09

MONAI: Unsafe torch usage may lead to arbitrary code execution

GHSA-6vm5-6jv9-rjpj · CVE-2025-58756

high2025-09-09

MONAI does not prevent path traversal, potentially leading to arbitrary file writes

GHSA-x6ww-pf9m-m73m · CVE-2025-58755