Vulnerability PYSEC-2026-4020
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
4 days ago
September 27, 2026 at 02:17 AM UTC
No summary available
0.0.1 - 1.5.2
0.0.1 - 1.5.2
Details
MONAI before 1.6.0 contains an unsafe deserialization vulnerability in the NumpyReader class that unconditionally uses numpy.load with allow_pickle=True when loading .npy and .npz files. Attackers can craft malicious .npy files with pickle payloads that execute arbitrary code when loaded through MONAI's standard data pipeline.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
High Risk
4 days ago
No summary available
0.0.1 - 1.5.2rc1 PYSEC-2026-4021
0.0.1 - 1.5.2rc1 PYSEC-2026-4021
Unknown
4 days ago
No summary available
0.0.1 - 1.6.0 PYSEC-2026-4015
0.0.1 - 1.6.0 PYSEC-2026-4015
Unknown
4 days ago
No summary available
PYSEC-2026-4016
High Risk
4 days ago
No summary available
0.0.1 - 1.6.0 PYSEC-2026-4017
0.0.1 - 1.6.0 PYSEC-2026-4017
Unknown
4 days ago
No summary available
0.0.1 - 1.5.2 PYSEC-2026-4018
0.0.1 - 1.5.2 PYSEC-2026-4018
Impacted packages
Timeline
Published
4 days ago
September 27, 2026 at 02:17 AM UTC
Fixed (1.6.0)
3 months ago
June 22, 2026 at 04:47 PM UTC
Last Modified
2 hours ago
October 01, 2026 at 09:15 AM UTC