Hnking-Star

**Name of the Vulnerable Software and Affected Versions** MONAI versions prior to 1.5.2 **Description** An issue exists where untrusted data is deserialized in the `algo from pickle()` function within monai/auto3dseg/utils.py. The function processes .pkl files using `pickle.loads()` without validating the source or content. An attacker can provide a malicious pickle file containing an object that defines ` reduce `, which is then executed during deserialization, leading to arbitrary code execution within the application context. **Recommendations** Update to version 1.5.2 or later. As a temporary mitigation, avoid using the `algo from pickle()` function with files from untrusted sources.