Threats tagged 'ghsa-59gw-w64r-2mg7'

MONAI versions prior to 1.6.1 have a vulnerability in the check_hash() function where integrity verification is insufficient. Specifically, if the hash value is None, the function silently returns True, and MD5 is used as the default hash type. This flaw allows attackers who can perform man-in-the-middle or registry compromise attacks to substitute bundles, datasets, or model archives downloaded without hashes. Such substitution can lead to malicious file delivery and potential code execution.