CVE-2025-58756: MONAI Medical Open Network RCE Vulnerability

CVE-2025-58756 Overview

CVE-2025-58756 is an insecure deserialization vulnerability [CWE-502] in MONAI (Medical Open Network for AI), an AI toolkit for healthcare imaging. The flaw affects versions up to and including 1.5.0. While monai/bundle/scripts.py uses torch.load with weights_only=True, other code paths in the project still load checkpoints insecurely. Attackers can craft malicious checkpoint files that execute arbitrary code during deserialization. Users frequently download pre-trained models from third-party platforms to reduce training cost and time, expanding the attack surface. At publication, no fixed version is available.

Critical Impact
A malicious pre-trained model checkpoint loaded into MONAI can trigger Python deserialization and execute arbitrary code with the privileges of the user running the AI workload.

Affected Products

MONAI (Medical Open Network for AI) versions up to and including 1.5.0
Workflows that load PyTorch checkpoints via insecure torch.load paths outside monai/bundle/scripts.py
Environments consuming third-party pre-trained MONAI model checkpoints

Discovery Timeline

2025-09-09 - CVE-2025-58756 published to the National Vulnerability Database (NVD)
2025-09-19 - Last updated in NVD database

Technical Details for CVE-2025-58756

Vulnerability Analysis

The vulnerability is an insecure deserialization issue rooted in PyTorch's torch.load function. When weights_only=True is not specified, torch.load uses Python's pickle module, which can execute arbitrary code defined inside the serialized object via __reduce__ methods.

MONAI's bundle loader at monai/bundle/scripts.py correctly passes weights_only=True, restricting deserialization to tensor data. However, other modules in the project, including checkpoint loaders, invoke torch.load without this safeguard. Loading an attacker-controlled checkpoint therefore triggers arbitrary Python execution inside the MONAI process.

Healthcare imaging pipelines often run with access to patient data, GPU compute, and internal networks, amplifying the consequences of code execution. See the MONAI GitHub Security Advisory GHSA-6vm5-6jv9-rjpj for advisory details.

Root Cause

The root cause is inconsistent application of safe loading practices. Some paths enforce weights_only=True, but checkpoint-loading helpers fall back to pickle-based deserialization. PyTorch documentation explicitly warns that torch.load without weights_only=True is unsafe with untrusted input. This maps to [CWE-502: Deserialization of Untrusted Data].

Attack Vector

An attacker publishes a malicious checkpoint file on a model-sharing platform or otherwise convinces a user to load it. When the MONAI workflow calls the vulnerable torch.load path, the embedded payload runs during unpickling. No interactive user action beyond loading the model is required, and the network attack vector reflects the typical model-distribution pattern.

The malicious payload is constructed by defining a class with a __reduce__ method that returns a system command. Once the checkpoint is unpickled by torch.load, the returned callable executes inside the host process. Refer to the vendor advisory for full technical details.

Detection Methods for CVE-2025-58756

Indicators of Compromise

Unexpected child processes spawned by Python interpreters running MONAI workloads, such as sh, bash, curl, or wget.
Outbound network connections from data science hosts immediately after a checkpoint load operation.
.pt, .pth, or .ckpt files downloaded from untrusted sources and present on training or inference hosts.
Modifications to user profile scripts, cron entries, or SSH authorized keys following model loading.

Detection Strategies

Hunt for torch.load invocations in MONAI code paths that omit the weights_only=True argument.
Inspect checkpoint files with pickletools to detect GLOBAL opcodes referencing os, subprocess, posix, or builtins.eval.
Correlate process lineage where python is the parent of shell or network utility processes during model load events.

Monitoring Recommendations

Log and alert on all checkpoint downloads from public repositories to AI/ML training nodes.
Monitor egress traffic from GPU clusters and isolate workloads handling untrusted models.
Track file integrity on directories storing pre-trained models and flag new or modified .pt and .pth files.

How to Mitigate CVE-2025-58756

Immediate Actions Required

Treat every third-party MONAI checkpoint as untrusted until a fix is published.
Audit internal code for torch.load calls and add weights_only=True wherever checkpoints are deserialized.
Run MONAI workflows in isolated containers or virtual machines without access to sensitive data or production networks.
Restrict outbound network access from training and inference hosts to known model registries.

Patch Information

As of the publication of CVE-2025-58756, no fixed MONAI version is available. Track the MONAI GitHub Security Advisory GHSA-6vm5-6jv9-rjpj for updates and apply releases as soon as they ship.

Workarounds

Only load checkpoints produced and signed by trusted internal pipelines.
Convert untrusted checkpoints to safetensors format before loading into MONAI.
Patch local MONAI installations to force weights_only=True on all torch.load calls until an upstream fix lands.
Execute model-loading code under a least-privilege service account with no shell, package manager, or outbound internet access.

bash

# Configuration example: scan a checkpoint for unsafe pickle opcodes before loading
python -m pickletools -a suspicious_model.pt | grep -E "GLOBAL|REDUCE|INST|OBJ"

# Force safe loading via environment-enforced wrapper
grep -RIn "torch.load(" ./ | grep -v "weights_only=True"