MONAI CVE-2026-109361

Exploitation requires (1) the attacker to have write access to the nnU-Net results/dataset directory so they can modify inference_information.json, (2) the ability to place a malicious Python pickle at a path they then reference via the postprocessing_file field, and (3) a legitimate operator to subsequently invoke predict_ensemble_postprocessing in nnUNetV2Runner (the UI:P passive-interaction requirement). Key LIMITING factors: the attack vector is LOCAL (AV:L) - no remote/network exploitation - and the attacker needs pre-existing low-privilege filesystem write access (PR:L), so this is only exploitable by users already present on the host or in multi-tenant/shared compute environments, not against default internet-facing deployments. In MONAI 1.6.1+ the path is confined to the dataset results directory and pickle loading is gated behind MONAI_ALLOW_PICKLE, further narrowing exploitability post-patch.

This is a locally-scoped, low-severity-to-moderate priority issue rather than a mass-exploitation threat. The authoritative CVSS 4.0 vector (CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H, score 7.0) tells a consistent story with the description: exploitation is LOCAL (AV:L), requires some privileges (PR:L - the attacker must already be able to write inference_information.json on the target filesystem), and requires passive user interaction (UI:P - a legitimate operator must run predict_ensemble_postprocessing). Impact is full code execution (VC:H/VI:H/VA:H) with no scope change to other systems (SC:N/SI:N/SA:N). No EPSS score, no CISA KEV listing, and no public POC were provided in the intelligence; exploitation status is therefore 'no public exploit identified at time of analysis.' The absence of EPSS/KEV signals combined with the local attack vector and prerequisite write access strongly indicates this is NOT a widespread, internet-facing threat but a privilege-dependent, supply-chain/trust-boundary flaw. The real-world risk concentrates in multi-user research/compute environments where one user's write access to another's results directory becomes a code-execution pivot. A patch is confirmed available from the vendor, which should be the primary mitigation.

In a shared medical-imaging compute environment, an attacker who can write to another user's nnU-Net results directory edits inference_information.json so its postprocessing_file field points to an attacker-planted malicious pickle elsewhere on the filesystem. When the victim operator subsequently runs predict_ensemble_postprocessing in nnUNetV2Runner, MONAI unpickles the attacker-controlled file and executes arbitrary code in the victim's context. No public exploit code was identified in the provided intelligence, but the mechanism is straightforward given write access.