CVE-2026-100845 [HIGH] – MONAI before 1.6.0 contains an unsafe deserialization vulnerability in the NumpyReader cla

MONAI before 1.6.0 contains an unsafe deserialization vulnerability in the NumpyReader class that unconditionally uses numpy.load with allow_pickle=True when loading .npy and .npz files. Attackers can craft malicious .npy files with pickle payloads that execute arbitrary code when loaded through MONAI’s standard data pipeline.