PT-2026-110777 · Project Monai+1 · Monai
CVSS v4.0
7.7
High
| Vector | AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
MONAI versions 0.4.0 through 1.6.0
Description
An issue exists where on-path attackers can achieve remote code execution by tampering with SENet pretrained weights fetched over plaintext HTTP. This occurs when the
load state dict from url() function unpickles a crafted .pth file without setting weights only=True. The code execution is triggered when SEResNet50 or other SENet models are initialized with the pretrained variable set to True.Recommendations
Update MONAI to version 1.6.1 or later.
Exploit
Fix
Deserialization of Untrusted Data
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Monai