[GHSA-89gg-p5r5-q6r4] MONAI: Unsafe functions lead to pickle deserialization rce#8151
Conversation
|
Hi there @ericspod! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository. This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory |
github-actions
Bot
changed the base branch from
main
to
mingxin-zheng/advisory-improvement-8151
There was a problem hiding this comment.
Pull request overview
Updates the GHSA advisory entry for MONAI pickle deserialization RCE by adjusting the advisory metadata for the affected version range boundary.
Changes:
- Updated the advisory
modifiedtimestamp. - Changed the first
fixedversion in the affected range from1.5.2to1.6.0.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| { | ||
| "fixed": "1.5.2" | ||
| "fixed": "1.6.0" | ||
| } |
Updates
Comments
If a user explicitly sets MONAI_ALLOW_PICKLE=1 and loads an untrusted .pkl, it's still exploitable. But the default-on attack surface is gone,