CVE-2025-58757HIGH 8.8EPSS p44.1%

CVE-2025-58757CVE-2025-58757

Description

MONAI (Medical Open Network for AI) is an AI toolkit for health care imaging. In versions up to and including 1.5.0, the `pickle_operations` function in `monai/data/utils.py` automatically handles dictionary key-value pairs ending with a specific suffix and deserializes them using `pickle.loads()` . This function also lacks any security measures. The deserialization may lead to code execution. As of time of publication, no known fixed versions are available.

Scoring

CVSS 3.18.8 (HIGH)
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS0.60% probability of exploitation · percentile 44.1% · 2026-06-19T12:03:05Z
Published2025-09-09
Last modified2025-09-19

Underlying weaknesses· 1

CWE-502

References

  1. https://github.com/Project-MONAI/MONAI/security/advisories/GHSA-p8cm-mm2v-gwjm
  2. https://github.com/Project-MONAI/MONAI/security/advisories/GHSA-p8cm-mm2v-gwjm

1

TypeTargetConfidenceTier
WeaknessDeserialization of Untrusted Datacwe-5020%live

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.

CVE
CVE-2025-58756
CVE
CVE-2025-58755
CVE
CVE-2025-65213
CVE
CVE-2026-31214
CVE
CVE-2025-1945
CVE
CVE-2026-31235
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.