CVE-2026-100846

Katalog CVE

CVSS 8.8 · High EPSS 0,29%

Kerentanan Deserialization of Untrusted Data pada project-monai monai. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

MONAI before 1.5.2 contains a deserialization of untrusted data vulnerability in the algo_from_pickle function in monai/auto3dseg/utils.py. The function reads a .pkl file and passes its contents to pickle.loads without validating the data source or content. If an application invokes algo_from_pickle on an attacker-supplied pickle file, an object defining __reduce__ is executed during deserialization, resulting in arbitrary code execution in the context of the application.

Rincian

Terbit di NVD

27 September 2026

Terakhir diubah

8 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-502: Deserialization of Untrusted Data

EPSS (30 hari)

0,29% peluang dieksploitasi; lebih tinggi dari 20,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/Project-MONAI/MONAI/security/advisories/GHSA-89gg-p5r5-q6r4 exploit · advisory vendor
• https://www.vulncheck.com/advisories/monai-before-1.5.2-remote-code-execution-via-pickle-deserialization advisory pihak ketiga