Executive brief
nnU-Net is an open-source framework used for medical image segmentation. A vulnerability in its automated GitHub issue management system allows any user to manipulate an AI-driven triage agent by submitting a specially crafted issue. This could allow an attacker to force the AI agent to perform unauthorized actions, such as posting misleading comments or incorrectly labeling issues, potentially disrupting project management and damaging the repository's reputation.
Technical details
The nnU-Net Issue Triage workflow (.github/workflows/issue-triage.yml) is vulnerable to Agentic Workflow Injection (CWE-1427). The workflow uses the 'anthropics/claude-code-action' and directly embeds untrusted issue titles and bodies into the AI prompt. Because the workflow is configured with 'allowed_non_write_users' set to the issue author's login, any GitHub user can trigger the workflow. The AI agent is granted 'issues: write' permissions and access to command-line tools (gh, ls, cat, etc.), allowing a remote attacker to use prompt injection to steer the agent into performing authenticated repository actions like commenting or relabeling. This issue is fixed in version 2.4.1.
Affected products
- MIC-DKFZ nnU-Net < 2.4.1
Timeline
- 2026-04-28: advisory: GitHub Security Advisory GHSA-63mx-j37w-gh59 published
- 2026-05-12: disclosed: CVE-2026-44246 published