CVE-2025-58757: falha de alta gravidade em Project-MONAI MONAI
MONAI's unsafe use of Pickle deserialization may lead to RCE
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.8epss 0.6%
MONAI (Medical Open Network for AI) is an AI toolkit for health care imaging. In versions up to and including 1.5.0, the `pickle_operations` function in `monai/data/utils.py` automatically handles dictionary key-value pairs ending with a specific suffix and deserializes them using `pickle.loads()` . This function also lacks any security measures. The deserialization may lead to code execution. As of time of publication, no known fixed versions are available.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Produtos afetados
Project-MONAI · MONAICVEs relacionadas — Project-MONAI MONAI
No mesmo produto, das mais perigosas para as menos.
CVE-2026-100844HIGHMONAI before 1.6.0 OS Command Injection via dataset_name_or_idEPSS 0.9%CVE-2025-58756HIGHMONAI's unsafe torch usage may lead to arbitrary code executionEPSS 0.8%CVE-2025-58755HIGHMONAI has path traversal issue that may lead to arbitrary file writesEPSS 0.6%CVE-2026-109360HIGHMONAI 0.4.0 before 1.6.1 RCE via SENet Pretrained Weights Over Plaintext HTTPEPSS 0.6%CVE-2026-119578HIGHMONAI 1.6.0 before 1.6.1 Code Execution via Auto3DSeg algo_from_json()EPSS 0.6%CVE-2026-48705CRITICALMONAI: MONAILabel Server Crash and Silent Inference Corruption via Crafted DICOM (pydicom DS/IS Validation Bypass)EPSS 0.5%