CVE-2026-109361

Katalog CVE

CVSS 7.3 · High EPSS 0,23%

Kerentanan Deserialization of Untrusted Data. Skor CVSS 3.1 7.3 (High) menurut vulncheck.com.

Deskripsi (NVD)

MONAI 1.2.0 before 1.6.1 contains an insecure deserialization vulnerability in nnUNetV2Runner that unpickles the postprocessing_file path read from inference_information.json without confining it to the results directory. Attackers who can modify inference_information.json can point it at a malicious pickle elsewhere on the filesystem to execute code when predict_ensemble_postprocessing runs.

Rincian

Terbit di NVD

12 Oktober 2026

Terakhir diubah

12 Oktober 2026

Status NVD

Received

CVSS 3.1

7.3 (High), sumber vulncheck.com
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-502: Deserialization of Untrusted Data

EPSS (30 hari)

0,23% peluang dieksploitasi; lebih tinggi dari 13,2% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/Project-MONAI/MONAI/commit/08576205c4de3c214976294d1dec8f7b2e78cdb9
• https://github.com/Project-MONAI/MONAI/security/advisories/GHSA-8f32-8649-rv87
• https://www.vulncheck.com/advisories/monai-1.2.0-before-1.6.1-insecure-deserialization-rce-via-nnunetv2runner-...