CVE-2026-109360: falha de alta gravidade em Project-MONAI MONAI
MONAI 0.4.0 before 1.6.1 RCE via SENet Pretrained Weights Over Plaintext HTTP
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.7epss 0.6%
MONAI 0.4.0 before 1.6.1 contains a remote code execution vulnerability that allows on-path attackers to execute code by tampering with SENet pretrained weights fetched over plaintext HTTP. Attackers can substitute a crafted .pth file that load_state_dict_from_url unpickles without weights_only=True, executing code when SEResNet50 or other SENet models are constructed with pretrained=True.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
Project-MONAI · MONAICVEs relacionadas — Project-MONAI MONAI
No mesmo produto, das mais perigosas para as menos.
CVE-2026-100844HIGHMONAI before 1.6.0 OS Command Injection via dataset_name_or_idEPSS 0.9%CVE-2025-58756HIGHMONAI's unsafe torch usage may lead to arbitrary code executionEPSS 0.8%CVE-2025-58757HIGHMONAI's unsafe use of Pickle deserialization may lead to RCEEPSS 0.6%CVE-2025-58755HIGHMONAI has path traversal issue that may lead to arbitrary file writesEPSS 0.6%CVE-2026-119578HIGHMONAI 1.6.0 before 1.6.1 Code Execution via Auto3DSeg algo_from_json()EPSS 0.6%CVE-2026-48705CRITICALMONAI: MONAILabel Server Crash and Silent Inference Corruption via Crafted DICOM (pydicom DS/IS Validation Bypass)EPSS 0.5%