{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-05-04T15:13:53.692","vulnerabilities":[{"cve":{"id":"CVE-2026-21851","sourceIdentifier":"security-advisories@github.com","published":"2026-01-07T23:15:50.677","lastModified":"2026-02-02T15:13:47.910","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"MONAI (Medical Open Network for AI) is an AI toolkit for health care imaging. In versions up to and including 1.5.1, a Path Traversal (Zip Slip) vulnerability exists in MONAI's `_download_from_ngc_private()` function. The function uses `zipfile.ZipFile.extractall()` without path validation, while other similar download functions in the same codebase properly use the existing `safe_extract_member()` function. Commit 4014c8475626f20f158921ae0cf98ed259ae4d59 fixes this issue."},{"lang":"es","value":"MONAI (Medical Open Network for AI) es un kit de herramientas de IA para imágenes médicas. En versiones hasta la 1.5.1 inclusive, una vulnerabilidad de Salto de Ruta (Zip Slip) existe en la función _download_from_ngc_private() de MONAI. La función utiliza zipfile.ZipFile.extractall() sin validación de ruta, mientras que otras funciones de descarga similares en la misma base de código utilizan correctamente la función safe_extract_member() existente. El commit 4014c8475626f20f158921ae0cf98ed259ae4d59 corrige este problema."}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":3.6}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:project-monai:monai:*:*:*:*:*:*:*:*","versionEndIncluding":"1.5.1","matchCriteriaId":"A887CB32-431C-4AFD-8C59-B2262427288D"}]}]}],"references":[{"url":"https://github.com/Project-MONAI/MONAI/commit/4014c8475626f20f158921ae0cf98ed259ae4d59","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/Project-MONAI/MONAI/security/advisories/GHSA-9rg3-9pvr-6p27","source":"security-advisories@github.com","tags":["Exploit","Vendor Advisory","Mitigation"]},{"url":"https://github.com/Project-MONAI/MONAI/security/advisories/GHSA-9rg3-9pvr-6p27","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Vendor Advisory","Mitigation"]}]}}]}