CVE-2026-109361 | Project-MONAI up to 1.6.0 nnUNetV2Runner inference_information.json predict_ensemble_postprocessing postprocessing_file deserialization

October 12, 2026 Yanac

A vulnerability described as problematic has been identified in Project-MONAI MONAI up to 1.6.0. This vulnerability affects the function predict_ensemble_postprocessing of the file inference_information.json of the component nnUNetV2Runner. The manipulation of the argument postprocessing_file results in deserialization.

This vulnerability is identified as CVE-2026-109361. The attack is only possible with local access. There is not any exploit available.

Upgrading the affected component is recommended.VulDB Recent EntriesRead More