https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 08:10:37 +0000 https://vulnerability.circl.lu/vuln/cve-2026-100843 <p><strong>Affected:</strong> Project-MONAI MONAI</p> <p>MONAI versions before 1.6.0 contain a remote code execution vulnerability in the algo_from_pickle() function due to unsafe pickle.loads() deserialization in monai/auto3dseg/utils.py. Attackers can craft malicious pickle files that execute arbitrary system commands when deserialized by the vulnerable function.</p> <p><strong>Affected:</strong> Project-MONAI MONAI</p> <p>MONAI versions before 1.6.0 contain a remote code execution vulnerability in the algo_from_pickle() function due to unsafe pickle.loads() deserialization in monai/auto3dseg/utils.py. Attackers can craft malicious pickle files that execute arbitrary system commands when deserialized by the vulnerable function.</p> https://vulnerability.circl.lu/vuln/cve-2026-100843 https://vulnerability.circl.lu/vuln/ghsa-qxq5-qhx6-94qw <p><strong>Affected:</strong> PyPI: monai</p> <p>## Summary</p> <p>GHSA-89gg-p5r5-q6r4 claims the pickle deserialization vulnerability in `algo_from_pickle()` was fixed in v1.5.2. However, `monai/auto3dseg/utils.py` has not been modified since 2024-07-12 — 18 months before v1.5.2 was released (2026-01-29). All three `pickle.loads()` calls remain unchanged. The fix was never implemented.</p> <p>## Vulnerable Code</p> <p>File: `monai/auto3dseg/utils.py` (last commit: 2024-07-12, unchanged in v1.5.2)</p> <p>```python def algo_from_pickle(pkl_filename: str, ...): with open(pkl_filename, &#34;rb&#34;) as f_pi: data_bytes = f_pi.read() data = pickle.loads(data_bytes) # SINK 1 — line 321, RCE fires here</p> <p># isinstance/key checks happen AFTER deserialization — already too late</p> <p>algo_bytes = data.pop(&#34;algo_bytes&#34;) ... if len(template_paths_candidates) == 0: algo = pickle.loads(algo_bytes) # SINK 2 — line 350 else: for p in template_paths_candidates: algo = pickle.loads(algo_bytes) # SINK 3 — line 356</p> <p>No Unpickler subclass, no find_class restriction, no allowlist.</p> <p>Why the Fix is Incomplete</p> <p>- monai/auto3dseg/utils.py last commit: 2024-07-12 (&#34;drop python 3.8&#34;) - v1.5.2 released: 2026-01-29 — release notes contain no pickle-related changes - v1.5.1 and v1.5.2 contain identical code at lines 321, 350, 356 - GHSA-89gg-p5r5-q6r4 references a Zip Slip fix (unrelated) as the patch</p> <p>PoC</p> <p>import pickle, os</p> <p>class Exploit: def __re…</p> <p><strong>Affected:</strong> PyPI: monai</p> <p>## Summary</p> <p>GHSA-89gg-p5r5-q6r4 claims the pickle deserialization vulnerability in `algo_from_pickle()` was fixed in v1.5.2. However, `monai/auto3dseg/utils.py` has not been modified since 2024-07-12 — 18 months before v1.5.2 was released (2026-01-29). All three `pickle.loads()` calls remain unchanged. The fix was never implemented.</p> <p>## Vulnerable Code</p> <p>File: `monai/auto3dseg/utils.py` (last commit: 2024-07-12, unchanged in v1.5.2)</p> <p>```python def algo_from_pickle(pkl_filename: str, ...): with open(pkl_filename, &#34;rb&#34;) as f_pi: data_bytes = f_pi.read() data = pickle.loads(data_bytes) # SINK 1 — line 321, RCE fires here</p> <p># isinstance/key checks happen AFTER deserialization — already too late</p> <p>algo_bytes = data.pop(&#34;algo_bytes&#34;) ... if len(template_paths_candidates) == 0: algo = pickle.loads(algo_bytes) # SINK 2 — line 350 else: for p in template_paths_candidates: algo = pickle.loads(algo_bytes) # SINK 3 — line 356</p> <p>No Unpickler subclass, no find_class restriction, no allowlist.</p> <p>Why the Fix is Incomplete</p> <p>- monai/auto3dseg/utils.py last commit: 2024-07-12 (&#34;drop python 3.8&#34;) - v1.5.2 released: 2026-01-29 — release notes contain no pickle-related changes - v1.5.1 and v1.5.2 contain identical code at lines 321, 350, 356 - GHSA-89gg-p5r5-q6r4 references a Zip Slip fix (unrelated) as the patch</p> <p>PoC</p> <p>import pickle, os</p> <p>class Exploit: def __re…</p> https://vulnerability.circl.lu/vuln/ghsa-qxq5-qhx6-94qw