Monai

This hub aggregates every CVE we track for Monai, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Monai.

• CVE-2026-100846MONAI before 1.5.2 Remote Code Execution via Pickle Deserialization7.6Sep 27, 2026
• CVE-2026-100845MONAI before 1.6.0 Remote Code Execution via NumpyReader7.8Sep 27, 2026
• CVE-2026-100844MONAI before 1.6.0 OS Command Injection via dataset_name_or_id8.4Sep 27, 2026
• CVE-2026-100842MONAI through 1.6.0 _get_fake_spatial_shape eval() Sandbox Bypass via Attribute Chains7.0Sep 27, 2026
• CVE-2026-100843MONAI before 1.6.0 Remote Code Execution via algo_from_pickle7.8Sep 27, 2026
• CVE-2026-100841MONAI 1.6.0 PersistentDataset Remote Code Execution via Pickle Cache7.8Sep 27, 2026
• CVE-2026-100840MONAI through 1.6.0 Remote Code Execution via bundle configuration7.8Sep 27, 2026
• GHSA-wg9g-w2j2-8pgrMONAI: Unsafe deserialization in NumpyReader allows arbitrary code execution via malicious .npy filesAug 18, 2026
• GHSA-rghg-q7wp-9767MONAI vulnerable to OS command injectionAug 18, 2026
• GHSA-qxq5-qhx6-94qwIncomplete Fix in MONAI: algo_from_pickle() pickle.loads() RCE still present in v1.5.2 despite GHSA-89gg-p5r5-q6r4 claiming patchAug 18, 2026
• GHSA-89gg-p5r5-q6r4MONAI: Unsafe functions lead to pickle deserialization rceApr 7, 2026
• CVE-2026-21851MONAI has Path Traversal (Zip Slip) in NGC Private Bundle Download5.3Jan 7, 2026
• CVE-2025-58757MONAI's unsafe use of Pickle deserialization may lead to RCE8.8Sep 8, 2025
• CVE-2025-58756MONAI's unsafe torch usage may lead to arbitrary code execution8.8Sep 8, 2025
• CVE-2025-58755MONAI has path traversal issue that may lead to arbitrary file writes8.8Sep 8, 2025