CVE-2026-109361 is a high severity insecure deserialization flaw (CVSS 7.3) in MONAI, the medical imaging framework. nnUNetV2Runner loads a pickle file from a path read out of inference_information.json, so someone who controls that file can run code. The fix is MONAI 1.6.1.
What's affected
The record says MONAI from 1.2.0 before 1.6.1 is affected. The GitHub advisory GHSA-8f32-8649-rv87, published on 27 September 2026 and rated High, lists the pip package monai with affected versions up to and including 1.6.0 and a patched version of 1.6.1. VulnCheck lists the range as 1.2.0 up to below 1.6.1 and scores it 7.0 under CVSS 4.0, against 7.3 under CVSS 3.1 in the record. All sources agree on 1.6.1 as the first fixed release.
The weakness is CWE-502, deserialization of untrusted data. The vector is local, low complexity, low privileges, with user interaction required, and high confidentiality, integrity and availability impact.
The flaw is in monai.apps.nnunet.nnunetv2_runner.nnUNetV2Runner. It matters if you run the runner, specifically the ensemble post processing step, against results directories or artifacts that someone else could influence, such as a shared or multi user results folder, or a nnU-Net artifact from another party.
How to check if you're exposed
Find the installed version:
pip show monai
pip list 2>/dev/null | grep -i monai
Versions from 1.2.0 to 1.6.0 are in range. Check every environment: virtual environments, notebooks, training containers and shared cluster images.
Then check whether you use the nnU-Net runner:
grep -rn "nnUNetV2Runner" --include=*.py --include=*.ipynb .
If you do, find the directory where the runner reads results, and list who can write to it. The advisory says the risk lies in an attacker influencing the JSON file that points at the post processing file. If only you can write there, your risk is low, but if it is a shared drive, take the fix seriously.
What to do now
- Upgrade monai to 1.6.1 or later in every environment and image, then rebuild images that bundle it.
- Restrict write access to nnU-Net results directories so only the training and inference accounts can change them.
- Do not run the runner on results folders or artifacts that come from outside your team without inspecting them.
- Run training and inference jobs under accounts with no access to patient data stores or secrets they do not need.
- Prefer data formats that cannot run code on load when you exchange model artifacts with others.
Why it matters
Python's pickle format can contain instructions to build objects, and loading a pickle can run code chosen by whoever wrote the file. Because of that, loading a pickle from an untrusted place is the same as running a program from that place.
The advisory says the runner reads a path from a JSON configuration file and passes it to a loader without checking where it points or gating the load. A file the attacker can edit, or an artifact from a second party, can therefore send the runner to a malicious pickle elsewhere on the disk. The advisory notes that MONAI uses an environment gated guard for the same hazard in other modules, and that this call site was simply missed. It was hidden because the loader came in through an aliased import that a text search for the usual names did not find.
The lesson for ML teams is that model and data artifacts are code. Medical imaging workloads often sit near sensitive data, which raises the stakes. The record does not mark this CVE as known exploited.
Try it yourself
See how this kind of finding shows up in a dependency workflow.
Click through it at your own pace, or open it full screen.
Quick check
Do I need to worry if only I write to my results folder?
The risk comes from files that others can influence. A private results folder lowers the risk, and upgrading still removes it.
Why was the unsafe load not caught earlier?
The advisory says the loader came from an aliased import that a search for the standard names missed.
Sources
You can also run a free in-browser dependency scan at gold.safeguard.sh/scan to see which of your packages carry known CVEs.
Last reviewed: 18 October 2026.
