CVE-2026-109361 Details
Description
MONAI 1.2.0 before 1.6.1 contains an insecure deserialization vulnerability in nnUNetV2Runner that unpickles the postprocessing_file path read from inference_information.json without confining it to the results directory. Attackers who can modify inference_information.json can point it at a malicious pickle elsewhere on the filesystem to execute code when predict_ensemble_postprocessing runs.
A vulnerability allowing insecure deserialization has been identified in MONAI versions 1.2.0 prior to 1.6.1. The issue resides in the nnUNetV2Runner component, where the postprocessing_file path is unpickled from inference_information.json without proper validation, allowing attackers to execute arbitrary code. This vulnerability can be exploited by modifying the inference_information.json file to point to a malicious pickle file elsewhere on the filesystem, which is then executed when the predict_ensemble_postprocessing function is called.
Users can update to MONAI version 1.6.1, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 12, 2026CISA-ADP
Assessed Oct 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-502 | Deserialization of Untrusted Data | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| MONAI | <= 1.6.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 26, 2026 | CVE Modified | CISA-ADP |
| Oct 12, 2026 | New CVE Received | [email protected] |