{"data":{"id":"169dcba8-4c39-40e1-b735-5a46652a2528","title":"CVE-2025-58756: MONAI (Medical Open Network for AI) is an AI toolkit for health care imaging. In versions up to and including 1.5.0, in…","summary":"MONAI, an AI toolkit for health care imaging, versions up to and including 1.5.0, is affected by CVE-2025-58756. Although `torch.load` with `weights_only=True` is used safely in monai/bundle/scripts.py, insecure loading methods remain elsewhere in the project, such as when loading checkpoints. Loading a checkpoint containing malicious content can trigger a deserialization vulnerability and lead to code execution.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-58756","publishedAt":"2025-09-09T00:15:32.457Z","cveId":"CVE-2025-58756","cweIds":["CWE-502"],"cvssScore":"8.8","cvssSeverity":"high","severity":"high","attackType":["supply_chain"],"issueType":"vulnerability","affectedPackages":["monai@<= 1.5.0 (fixed: 1.5.1)"],"affectedPackageNames":["monai"],"affectedPackageRefs":["pypi:monai"],"affectedVendors":[],"affectedVendorsRaw":["MONAI"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"MONAI insecure checkpoint loading enables deserialization code execution","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.0075,"epssCheckedAt":"2026-11-04T18:09:14.469Z","kevDateAdded":null,"advisoryAliases":["GHSA-6vm5-6jv9-rjpj"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:52:48.437Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2025-09-22T17:39:57.624Z","daysToFix":13,"fixCheckedAt":"2026-10-29T21:43:50.665Z","capecIds":["CAPEC-586"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":["AML.T0010"],"fixes":[{"ecosystem":"pypi","name":"monai","fixedVersion":"1.5.1","matchedVersion":"1.5.1","fixReleasedAt":"2025-09-22T17:39:57.624Z","daysToFix":13,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:43:50.515Z"}]}}