{"action":"Upgrade monai to 1.5.2 or later.","affected":[{"fixed":"1.5.2","introduced":"0"}],"component":"monai","cve_ids":["CVE-2026-100846"],"ecosystem":"PyPI","epss":0.00361,"exploited":false,"fixed_versions":["1.5.2"],"ghsa_id":"GHSA-89gg-p5r5-q6r4","id":"tcs_01M5KH9AQVZVR85J3B98V7GMSH","modified_at":"2026-10-01T09:15:05.348272565Z","published_at":"2026-09-27T02:17:23.283Z","references":["https://osv.dev/vulnerability/PYSEC-2026-4021","https://www.vulncheck.com/advisories/monai-before-1.5.2-remote-code-execution-via-pickle-deserialization","https://github.com/Project-MONAI/MONAI/security/advisories/GHSA-89gg-p5r5-q6r4"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"PYSEC-2026-4021","url":"https://osv.dev/vulnerability/PYSEC-2026-4021"}],"summary":"MONAI before 1.5.2 contains a deserialization of untrusted data vulnerability in the algo_from_pickle function in monai/auto3dseg/utils.py. The function reads a .pkl file and passes its contents to pi"}