CVE-2026-109361

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-109361

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-109361.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-109361

Aliases

GHSA-8f32-8649-rv87

Published

2026-10-12T16:05:40Z

Modified

2026-10-13T02:46:57Z

Severity

7.0 (High) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

MONAI 1.2.0 before 1.6.1 Insecure Deserialization RCE via nnUNetV2Runner postprocessing_file Path

Details

MONAI 1.2.0 before 1.6.1 contains an insecure deserialization vulnerability in nnUNetV2Runner that unpickles the postprocessing_file path read from inference_information.json without confining it to the results directory. Attackers who can modify inference_information.json can point it at a malicious pickle elsewhere on the filesystem to execute code when predict_ensemble_postprocessing runs.

Database specific

{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-502"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/109xxx/CVE-2026-109361.json"
}

References

Affected packages

Git / github.com/project-monai/monai

Affected ranges

Type

GIT

Repo

https://github.com/project-monai/monai

Events

Introduced

c33f1ba588ee00229a309000e888f9817b4f1934

Fixed

f2ec87ae9b536baaeca1d6bcc2b6349369e2af8f

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "1.2.0"
        },
        {
            "fixed":  "1.6.1"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

1.*

1.2.0

1.3.0

1.3.0rc1

1.3.0rc2

1.3.0rc3

1.3.0rc4

1.3.0rc5

1.3.1

1.3.1rc1

1.3.1rc2

1.3.1rc3

1.3.1rc4

1.3.1rc5

1.3.1rc6

1.3.1rc7

1.3.1rc8

1.3.3rc1

1.4.0

1.4.0rc1

1.4.0rc10

1.4.0rc11

1.4.0rc12

1.4.0rc2

1.4.0rc3

1.4.0rc4

1.4.0rc5

1.4.0rc6

1.4.0rc7

1.4.0rc8

1.4.0rc9

1.4.1rc1

1.5.0

1.5.0rc1

1.5.1

1.6.0

1.6.0rc1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-109361.json"