CVE-2025-58757

MONAI (Medical Open Network for AI) is an AI toolkit for health care imaging. In versions up to and including 1.5.0, the `pickle_operations` function in `monai/data/utils.py` automatically handles dictionary key-value pairs ending with a specific suffix and deserializes them using `pickle.loads()` . This function also lacks any security measures. The deserialization may lead to code execution. As of time of publication, no known fixed versions are available.

• CWE-502

• https://github.com/Project-MONAI/MONAI/security/advisories/GHSA-p8cm-mm2v-gwjmExploit, Vendor Advisory
• https://github.com/Project-MONAI/MONAI/security/advisories/GHSA-p8cm-mm2v-gwjmExploit, Vendor Advisory

Published

Sep 9, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-58751Vite is a frontend tooling framework for JavaScript. Prior t…5.3
• CVE-2025-58752Vite is a frontend tooling framework for JavaScript. Prior t…5.3
• CVE-2025-58753Copyparty is a portable file server. In versions prior to 1.…7.5
• CVE-2025-58754Axios is a promise based HTTP client for the browser and Nod…7.5
• CVE-2025-58755MONAI (Medical Open Network for AI) is an AI toolkit for hea…8.8
• CVE-2025-58756MONAI (Medical Open Network for AI) is an AI toolkit for hea…8.8
• CVE-2025-58758TinyEnv is an environment variable loader for PHP applicatio…7.3
• CVE-2025-58759TinyEnv is an environment variable loader for PHP applicatio…6.5
• CVE-2025-5876A vulnerability classified as problematic was found in Lucky…5.5
• CVE-2025-58760Tautulli is a Python based monitoring and tracking tool for …7.5
• CVE-2025-58761Tautulli is a Python based monitoring and tracking tool for …7.5
• CVE-2025-58762Tautulli is a Python based monitoring and tracking tool for …7.2