CVE-2025-58757
Last modified
CVE-2025-58757 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. MONAI (Medical Open Network for AI) is an AI toolkit for health care imaging. In versions up to and including 1.5.0, the `pickle_operations` function in `monai/data/utils.py` automatically handles dictionary key-value pairs ending with a specific suffix and deserializes them using `pickle.loads()` . EPSS estimates a 0.60% chance of exploitation in the next 30 days.
Description
MONAI (Medical Open Network for AI) is an AI toolkit for health care imaging. In versions up to and including 1.5.0, the `pickle_operations` function in `monai/data/utils.py` automatically handles dictionary key-value pairs ending with a specific suffix and deserializes them using `pickle.loads()` . This function also lacks any security measures. The deserialization may lead to code execution. As of time of publication, no known fixed versions are available.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Monai | Medical Open Network For Ai | <= 1.5.0 |
References
- https://github.com/Project-MONAI/MONAI/security/advisories/GHSA-p8cm-mm2v-gwjmExploit, Vendor Advisory
- https://github.com/Project-MONAI/MONAI/security/advisories/GHSA-p8cm-mm2v-gwjmExploit, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-58757?
How severe is CVE-2025-58757?
How do I fix CVE-2025-58757?
Are you affected by CVE-2025-58757?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST