CyberRota Analysis
AI-GeneratedMONAI versions prior to 1.5.2 are vulnerable due to a deserialization flaw in the algo_from_pickle function, which allows untrusted data to be processed without proper validation. This vulnerability can lead to arbitrary code execution if an application processes a maliciously crafted pickle file. Organizations using affected versions of MONAI should prioritize patching to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
MONAI before 1.5.2 contains a deserialization of untrusted data vulnerability in the algo_from_pickle function in monai/auto3dseg/utils.py. The function reads a .pkl file and passes its contents to pickle.loads without validating the data source or content. If an application invokes algo_from_pickle on an attacker-supplied pickle file, an object defining __reduce__ is executed during deserialization, resulting in arbitrary code execution in the context of the application.
Related CVEs
Other vulnerabilities affecting the same vendor(s)