CVSS 3.1
8.8 highCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HCVE-2025-58757
High (8.8) in monai medical open network for ai. EPSS 0.6% chance of exploitation in the next 30 days. Fixed in monai 1.5.1, 1.5.1rc1.
MONAI (Medical Open Network for AI) is an AI toolkit for health care imaging. In versions up to and including 1.5.0, the `pickle_operations` function in `monai/data/utils.py` automatically handles dictionary key-value pairs ending with a specific suffix and deserializes them using `pickle.loads()` . This function also lacks any security measures. The deserialization may lead to code execution. As of time of publication, no known fixed versions are available.
Severity
- EPSS
- 0.6% chance of exploitation in the next 30 days; higher than 50% of CVEs (scores of 2026-10-31)
- CWE
- CWE-502
- Published
- Modified
- Record from
- the NVD, synced
Affected
- monai:medical_open_network_for_ai
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-p8cm-mm2v-gwjm | PyPI | monai | <1.5.1 | 1.5.1 |
| PYSEC-2025-142 | PyPI | monai | <1.5.1rc1 | 1.5.1rc1 |