CVE-2026-100845 — MONAI before 1.6.0 Remote Code Execution via NumpyReader

Affected: Project-MONAI MONAI

MONAI before 1.6.0 contains an unsafe deserialization vulnerability in the NumpyReader class that unconditionally uses numpy.load with allow_pickle=True when loading .npy and .npz files. Attackers can craft malicious .npy files with pickle payloads that execute arbitrary code when loaded through MONAI's standard data pipeline.

GHSA-wg9g-w2j2-8pgr — MONAI: Unsafe deserialization in NumpyReader allows arbitrary code execution via malicious .npy files

Affected: PyPI: monai

### Summary

The `NumpyReader` class in `monai/data/image_reader.py` unconditionally uses `np.load(name, allow_pickle=True)` (line 1276), enabling arbitrary code execution when loading a crafted `.npy` or `.npz` file. This affects all MONAI versions up to and including the latest commit (5b71547). The `allow_pickle` parameter is hardcoded to `True` and cannot be overridden by the user (the docstring explicitly states kwargs are accepted "except `allow_pickle`").

### Details

**Vulnerable code** ([permalink](https://github.com/Project-MONAI/MONAI/blob/5b71547/monai/data/image_reader.py#L1276)):

```python # monai/data/image_reader.py, line 1276, in NumpyReader.read() img = np.load(name, allow_pickle=True, **kwargs_) ```

The `NumpyReader` is automatically selected by MONAI's `LoadImage` transform for any file with `.npy` or `.npz` extension (see `monai/transforms/io/array.py` line 68: `"numpyreader": NumpyReader`). This means the entire standard data pipeline (LoadImage, PersistentDataset, CacheDataset, SmartCacheDataset, etc.) is vulnerable.

The `allow_pickle=True` parameter enables Python's pickle protocol during numpy loading. Pickle is known to be unsafe for untrusted data, as it can execute arbitrary code during deserialization via the `__reduce__` method.

**Compare with safe practices in the same project:**

The MONAI project has already addressed similar deserialization issues in other code paths: - `torch.load` calls now use `weights_only=True` (after GHSA-6vm5-6jv…

Most recent entries from all

CVE-2026-100845 — MONAI before 1.6.0 Remote Code Execution via NumpyReader

GHSA-wg9g-w2j2-8pgr — MONAI: Unsafe deserialization in NumpyReader allows arbitrary code execution via malicious .npy files