CVE-2025-58757 MONAI's unsafe use of Pickle deserialization may lead to RCE
MONAI library allows remote code execution via unsafe pickle deserialization in data utilities, affecting healthcare AI applications.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-58757?
CVE-2025-58757 is a high-severity unsafe deserialization vulnerability in Project-MONAI MONAI, published on 8 Sep 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
MONAI (Medical Open Network for AI) is an AI toolkit for health care imaging. In versions up to and including 1.5.0, the `pickle_operations` function in `monai/data/utils.py` automatically handles dictionary key-value pairs ending with a specific suffix and deserializes them using `pickle.loads()` . This function also lacks any security measures. The deserialization may lead to code execution. As of time of publication, no known fixed versions are available.
Weakness: CWE-502
Which versions are affected by CVE-2025-58757?
3 open source packages ship an affected version, including monai. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
monai PyPI | All versions | 1.5.1 |
monai PyPI | All versions | 1.5.1 |
monai PyPI | All versions | 1.5.1rc1 |
Products include Monai Medical Open Network for Ai.
How do I fix CVE-2025-58757?
Upgrade monai to a fixed version for your release line: 1.5.1 or 1.5.1rc1.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2025-58757 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-58757 exists.
Other vulnerabilities in Project-MONAI MONAI
Sources
Also known as GHSA-p8cm-mm2v-gwjm, PYSEC-2025-142.