Executive brief
MONAI is a medical imaging toolkit used for training and validating neural network models. This vulnerability allows arbitrary OS commands to execute when loading a specially crafted YAML configuration file, enabling complete system compromise including data theft, system modification, and denial of service. An attacker who can control or inject a malicious YAML configuration file used by the training pipeline can execute any command with the privileges of the user running MONAI.
Technical details
This is an OS command injection vulnerability (CWE-78) in MONAI's nnUNetV2Runner component. The vulnerability exists in the nnunetv2_runner.py code which concatenates user-controlled values from YAML configuration files (specifically the "dataset_name_or_id" field) without proper quoting or validation before passing them to subprocess with shell=True. On Windows, an attacker can inject shell metacharacters like '&' to chain arbitrary commands; on Linux, semicolons (';') can be used. The attack requires only that a victim load a crafted YAML file via nnUNetV2Runner during training/validation job execution—there are no other preconditions such as authentication or user interaction beyond loading the config. A successful exploit grants the attacker arbitrary code execution with the same privileges as the MONAI process, allowing data exfiltration, integrity violations, and system availability attacks. The fix is available in MONAI version 1.6.0 and later, which properly sanitizes or quotes the user-controlled input before subprocess invocation.
Affected products
- Project-MONAI MONAI < 1.6.0
Timeline
- 2026-02-05: disclosed: Initial report submitted to JPCERT/CC and MONAI project
- 2026-03-11: disclosed: Re-submission by JPCERT/CC after no response
- 2026-06-11: advisory: GitHub advisory GHSA-rghg-q7wp-9767 published
- 2026-06-01: patched: Fix merged in pull request #8885
- 2026-06-11: patched: MONAI version 1.6.0 released with patch