{"items":[{"id":"NVI-00016394","kind":"vulnerability","title":"Incomplete Fix in MONAI: algo_from_pickle() pickle.loads() RCE still present in v1.5.2 despite GHSA-89gg-p5r5-q6r4 claiming      patch","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-qxq5-qhx6-94qw"],"plain_summary":"GitHub lists this reviewed advisory for monai. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-6d2ef1ab9c43b5e1487b9dbfa316fa7f"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-08-18T20:22:32.000Z","value":"7.8 high","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-6d2ef1ab9c43b5e1487b9dbfa316fa7f"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-6d2ef1ab9c43b5e1487b9dbfa316fa7f","url":"https://github.com/advisories/GHSA-qxq5-qhx6-94qw","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-qxq5-qhx6-94qw","publisher":"GitHub Advisory Database","observed_at":"2026-11-02T20:14:33.912Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-6d2ef1ab9c43b5e1487b9dbfa316fa7f"],"technology":"monai","known_exclusions":[],"conditions_summary":"## Summary\n\n  GHSA-89gg-p5r5-q6r4 claims the pickle deserialization vulnerability in\n  `algo_from_pickle()` was fixed in v1.5.2. However, `monai/auto3dseg/utils.py`\n  has not been modified since 2024-07-12 — 18 months before v1.5.2 was released\n  (2026-01-29). All three `pickle.loads()` calls remain unchanged. The fix was\n  never implemented.\n\n  ## Vulnerable Code\n\n  File: `monai/auto3dseg/utils.py` (last commit: 2024-07-12, unchanged in v1.5.2)\n\n  ```python\n  def algo_from_pickle(pkl_filename: str, ...):\n      with open(pkl_filename, \"rb\") as f_pi:\n          data_bytes = f_pi.read()\n      data = pickle.loads(data_bytes)          # SINK 1 — line 321, RCE fires here\n\n      # isinstance/key checks happen AFTER deserialization — already too late\n\n      algo_bytes = data.pop(\"algo_bytes\")\n      ...\n      if len(template_paths_candidates) == 0:\n          algo = pickle.loads(algo_bytes)      # SINK 2 — line 350\n      else:\n          for p in template_paths_candidates:\n              algo = pickle.loads(algo_bytes)  # SINK 3 — line 356\n\n  No Unpickler subclass, no find_class restriction, no allowlist.\n\n  Why the Fix is Incomplete\n\n  - monai/auto3dseg/utils.py last commit: 2024-07-12 (\"drop","public_affected_ranges":["< 1.6.0"]}],"null_published_at":"2026-11-04T10:04:27.939Z","source_updated_at":"2026-08-18T20:22:32.000Z","source_disclosed_at":"2026-08-18T20:22:30.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-02T20:14:33.912Z"}],"next_cursor":null,"snapshot_revision":"42594"}