The algo_from_pickle() function in monai/auto3dseg/utils.py deserializes attacker-controlled data with pickle.loads() at three call sites, with isinstance and key validation performed only after deserialization, so remote code execution fires before any check. An earlier advisory stated the issue was fixed in 1.5.2, but the file was unchanged and all three sinks remained. Fixed in 1.6.0, which gates the legacy pickle path behind the MONAI_ALLOW_PICKLE environment variable, deprecates algo_from_pickle and algo_to_pickle, and adds a pickle-free algo_to_json / algo_from_json path as the default.