Security Advisories

There are a number of open advisories in https://github.com/Project-MONAI/MONAI/security/advisories which should be addressed before the release. Many look like duplicates of existing advisories or issues that have been addressed already.

Warn before instantiating _target_ from algo_object.json #9085
Harden nnUNetV2Runner against code execution #9086
Reject non-finite DICOM affine metadata in PydicomReader #9087
Harden download/deserialize integrity (weights_only, hash checks, path confinement) #9088
Security Advisories, should open as draft when addressed then publish when 1.6.1 is released
CodeQL flagged issues: https://github.com/Project-MONAI/MONAI/security/code-scanning

The remaining CodeQL issues are related to logging filenames, conversion of values in C++ code possibly overflowing, and one thing related to the blossom script that I don't get:

If logging filename isn't a concern then the first set can be dismissed.
The overflow issues won't happen in practice with the C++ code since the variable used in the concerning expressions represents dimension size so will never be large.
The blossom script is probably going away soon so I don't feel it's a concern.

Navigation Menu

Repository navigation

Security Advisories #9084

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Security Advisories #9084

Description

Activity

ericspod commented on Sep 10, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions