Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

High severity, with a CVSS score of 8.6, published 18 August 2026.

Is there a fix for This vulnerability?

A patch was published on 2026-06-01: Fix merged in pull request #8885 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked with local access, in a software library.

Check whether you run monai (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

MONAI OS command injection in nnUNetV2Runner

Severity: high · CVSS 8.6 · Published 2026-08-18

MONAI is a medical imaging toolkit used for training and validating neural network models. This vulnerability allows arbitrary OS commands to execute when loading a specially crafted YAML configuration file, enabling complete system compromise including data theft, system modification, and denial of service. An attacker who can control or inject a malicious YAML configuration file used by the training pipeline can execute any command with the privileges of the user running MONAI.

Technologies: monai (PyPI). Vendors: PyPI.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: High severity, with a CVSS score of 8.6, published 18 August 2026.
Which products and versions are affected?: monai (PyPI) < 1.6.0.
Is there a fix for This vulnerability?: A patch was published on 2026-06-01: Fix merged in pull request #8885 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked with local access, in a software library.
Am I affected?: Check whether you run monai (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is an OS command injection vulnerability (CWE-78) in MONAI's nnUNetV2Runner component. The vulnerability exists in the nnunetv2_runner.py code which concatenates user-controlled values from YAML configuration files (specifically the "dataset_name_or_id" field) without proper quoting or validation before passing them to subprocess with shell=True. On Windows, an attacker can inject shell metacharacters like '&' to chain arbitrary commands; on Linux, semicolons (';') can be used. The attack requires only that a victim load a crafted YAML file via nnUNetV2Runner during training/validation job execution—there are no other preconditions such as authentication or user interaction beyond loading the config. A successful exploit grants the attacker arbitrary code execution with the same privileges as the MONAI process, allowing data exfiltration, integrity violations, and system availability attacks. The fix is available in MONAI version 1.6.0 and later, which properly sanitizes or quotes the user-controlled input before subprocess invocation.

Affected products

Project-MONAI MONAI < 1.6.0

Timeline

2026-02-05: disclosed: Initial report submitted to JPCERT/CC and MONAI project
2026-03-11: disclosed: Re-submission by JPCERT/CC after no response
2026-06-11: advisory: GitHub advisory GHSA-rghg-q7wp-9767 published
2026-06-01: patched: Fix merged in pull request #8885
2026-06-11: patched: MONAI version 1.6.0 released with patch

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.