Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-100843— MONAI before 1.6.0 Remote Code Execution via algo_from_pickle

Quick assessment

Affected

Project-MONAI MONAI

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

MONAI 1.6.0 之前的版本在中的函数存在远程代码执行漏洞。该漏洞是由于使用了不安全的反序列化操作所导致。攻击者可以构造恶意的 pickle 文件，在文件被易受攻击的函数反序列化时，执行任意系统命令。

CVSS 7.8 · High EPSS 0.19% · P8 Updated Sep 28, 2026

Possible ATT&CK Techniques 1 AI

T1203 · Exploitation for Client Execution

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

MONAI before 1.6.0 Remote Code Execution via algo_from_pickle

Source: CVE Program / CVE List V5

Vulnerability Description

MONAI versions before 1.6.0 contain a remote code execution vulnerability in the algo_from_pickle() function due to unsafe pickle.loads() deserialization in monai/auto3dseg/utils.py. Attackers can craft malicious pickle files that execute arbitrary system commands when deserialized by the vulnerable function.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

可信数据的反序列化

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Project-MONAI	MONAI	0 ~ 1.6.0	-

II. Public POCs for CVE-2026-100843

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-100843

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-100843 (1)

🔗 MONAI before 1.6.0 Remote Code Execution via algo_from_pickle | Advisories | VulnCheck third-party-advisory

Other References for CVE-2026-100843 (1)

https://github.com/Project-MONAI/MONAI/security/advisories/GHSA-qxq5-qhx6-94qw vendor-advisory

https://www.cve.org/CVERecord?id=CVE-2026-100843

Same Patch Batch · Project-MONAI · 2026-09-27 · 7 CVEs total

CVE-2026-100844	8.4 HIGH	MONAI before 1.6.0 OS Command Injection via dataset_name_or_id
CVE-2026-100841	7.8 HIGH	MONAI through 1.6.0 PersistentDataset Remote Code Execution via Pickle Cache
CVE-2026-100845	7.8 HIGH	MONAI before 1.6.0 Remote Code Execution via NumpyReader
CVE-2026-100840	7.8 HIGH	MONAI through 1.6.0 Remote Code Execution via bundle configuration
CVE-2026-100846	7.6 HIGH	MONAI before 1.5.2 Remote Code Execution via Pickle Deserialization
CVE-2026-100842	7.0 HIGH	MONAI through 1.6.0 _get_fake_spatial_shape eval() Sandbox Bypass via Attribute Chains

IV. Related Vulnerabilities

Same product: MONAI

Same vendor: Project-MONAI

Same weakness: CWE-502

V. Comments for CVE-2026-100843

No comments yet

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-100843— MONAI before 1.6.0 Remote Code Execution via algo_from_pickle

Quick assessment

Possible ATT&CK Techniques 1 AI

I. Basic Information for CVE-2026-100843

Vulnerability Information

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Affected Products

II. Public POCs for CVE-2026-100843

III. Intelligence Information for CVE-2026-100843

Vendor Advisories for CVE-2026-100843 (1)

Other References for CVE-2026-100843 (1)

Same Patch Batch · Project-MONAI · 2026-09-27 · 7 CVEs total

IV. Related Vulnerabilities

V. Comments for CVE-2026-100843

Leave a comment