CVE-2025-58756

MONAI (Medical Open Network for AI) is an AI toolkit for health care imaging. In versions up to and including 1.5.0, in `model_dict = torch.load(full_path, map_location=torch.device(device), weights_only=True)` in monai/bundle/scripts.py , `weights_only=True` is loaded securely. However, insecure loading methods still exist elsewhere in the project, such as when loading checkpoints. This is a common practice when users want to reduce training time and costs by loading pre-trained models downloaded from other platforms. Loading a checkpoint containing malicious content can trigger a deserialization vulnerability, leading to code execution. As of time of publication, no known fixed versions are available.

• CWE-502

• https://github.com/Project-MONAI/MONAI/security/advisories/GHSA-6vm5-6jv9-rjpjExploit, Vendor Advisory

Published

Sep 9, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-58750rAthena is an open-source cross-platform massively multiplay…9.1
• CVE-2025-58751Vite is a frontend tooling framework for JavaScript. Prior t…5.3
• CVE-2025-58752Vite is a frontend tooling framework for JavaScript. Prior t…5.3
• CVE-2025-58753Copyparty is a portable file server. In versions prior to 1.…7.5
• CVE-2025-58754Axios is a promise based HTTP client for the browser and Nod…7.5
• CVE-2025-58755MONAI (Medical Open Network for AI) is an AI toolkit for hea…8.8
• CVE-2025-58757MONAI (Medical Open Network for AI) is an AI toolkit for hea…8.8
• CVE-2025-58758TinyEnv is an environment variable loader for PHP applicatio…7.3
• CVE-2025-58759TinyEnv is an environment variable loader for PHP applicatio…6.5
• CVE-2025-5876A vulnerability classified as problematic was found in Lucky…5.5
• CVE-2025-58760Tautulli is a Python based monitoring and tracking tool for …7.5
• CVE-2025-58761Tautulli is a Python based monitoring and tracking tool for …7.5