CVE-2026-100844

MONAI before 1.6.0 is vulnerable to OS command injection in the nnUNetV2Runner component (monai.apps.nnunet.nnunetv2_runner). User-controlled values taken from the YAML configuration file (notably dataset_name_or_id) and from CLI/kwargs arguments are concatenated into a command string without quoting or validation and then passed to subprocess with shell=True, so shell metacharacters (e.g., ';' on Linux, '&' on Windows) are interpreted. If a victim loads and processes a crafted configuration file — for example by instantiating nnUNetV2Runner with the malicious YAML and invoking a training/validation job such as train_single_model() — arbitrary commands are executed with the privileges of the user running the job.

MONAI before 1.6.0 is vulnerable to OS command injection in the nnUNetV2Runner component (monai.apps.nnunet.nnunetv2_runner). User-controlled values taken from the YAML configuration file (notably dataset_name_or_id) and from CLI/kwargs arguments are concatenated into a command string without quoting or validation and then passed to subprocess with shell=True, so shell metacharacters (e.g., ';' on Linux, '&' on Windows) are interpreted. If a victim loads and processes a crafted configuration file — for example by instantiating nnUNetV2Runner with the malicious YAML and invoking a training/validation job such as train_single_model() — arbitrary commands are executed with the privileges of the user running the job.

Comment from JPCERT/CC

We are submitting the report again as we have yet to receive any responses from you after submitting it on February 5 and March 11.

It would be greatly appreciated if you could send us a message after confirming it so that we can follow up the case by email.

Summary

MONAI vulnerable to OS command injection.

Details

This library concatenates user-controlled values (YAML's "dataset_name_or_id" or part of "CLI/kwargs") without quoting or validation. Since this string is passed to subprocess with shell=True, shell metacharacters (e.g., Windows: & / Linux: ;) are interpreted.

As a result, arbitrary commands can be concatenated and executed. Therefore, the reporter identifies this as CWE-78 (OS Command Injection).

The victim needs to load a crafted YAML file in the code that launches training/validation jobs based on the configuration (YAML/arguments). There are no other constraints.

PoC

Verified on Windows. Load a modified YAML file with crafted "dataset_name_or_id" as follows. Add command separator characters (such as & or ;) and insert arbitrary commands.

dataset_name_or_id: '4 & echo "This is exploited" > "C:\Users\shima\OneDrive\Desktop\tmp\test.txt" & rem' dataroot: C:/Users/shima/OneDrive/Desktop/tmp/data datalist: C:/Users/shima/OneDrive/Desktop/tmp/lists/task4.json work_dir: C:/Users/shima/OneDrive/Desktop/tmp/work nnunet_raw: C:/Users/shima/OneDrive/Desktop/tmp/nnUNet_raw nnunet_preprocessed: C:/Users/shima/OneDrive/Desktop/tmp/nnUNet_preprocessed nnunet_results: C:/Users/shima/OneDrive/Desktop/tmp/nnUNet_results

As a victim, verify running the following Python code to load and process the YAML file.

from monai.apps.nnunet.nnunetv2_runner import nnUNetV2Runner from pathlib import Path #Path of the crafted YAML file YAML = r"C:\Users\shima\OneDrive\Desktop\tmp\test.yaml" #Text file overwritten when command executes OUT = Path(r"C:\Users\shima\OneDrive\Desktop\tmp\test.txt") #Read YAML runner = nnUNetV2Runner(input_config=YAML, trainer_class_name="nnUNetTrainer") runner.train_single_model(config="3d_fullres", fold=0, gpu_id=0) #Verify command execution print("Result:", OUT.read_text(encoding="utf-8").strip())

Also, see the attached file. JVN#50379904-details.zip

MONAI before 1.6.0 is vulnerable to OS command injection in the nnUNetV2Runner component (monai.apps.nnunet.nnunetv2_runner). User-controlled values taken from the YAML configuration file (notably dataset_name_or_id) and from CLI/kwargs arguments are concatenated into a command string without quoting or validation and then passed to subprocess with shell=True, so shell metacharacters (e.g., ';' on Linux, '&' on Windows) are interpreted. If a victim loads and processes a crafted configuration file — for example by instantiating nnUNetV2Runner with the malicious YAML and invoking a training/validation job such as train_single_model() — arbitrary commands are executed with the privileges of the user running the job.

MONAI before 1.6.0 is vulnerable to OS command injection in the nnUNetV2Runner component (monai.apps.nnunet.nnunetv2_runner). User-controlled values taken from the YAML configuration file (notably dataset_name_or_id) and from CLI/kwargs arguments are concatenated into a command string without quoting or validation and then passed to subprocess with shell=True, so shell metacharacters (e.g., ';' on Linux, '&' on Windows) are interpreted. If a victim loads and processes a crafted configuration file — for example by instantiating nnUNetV2Runner with the malicious YAML and invoking a training/validation job such as train_single_model() — arbitrary commands are executed with the privileges of the user running the job.

MONAI before 1.6.0 is vulnerable to OS command injection in the nnUNetV2Runner component (monai.apps.nnunet.nnunetv2_runner). User-controlled values taken from the YAML configuration file (notably dataset_name_or_id) and from CLI/kwargs arguments are concatenated into a command string without quoting or validation and then passed to subprocess with shell=True, so shell metacharacters (e.g., ';' on Linux, '&' on Windows) are interpreted. If a victim loads and processes a crafted configuration file — for example by instantiating nnUNetV2Runner with the malicious YAML and invoking a training/validation job such as train_single_model() — arbitrary commands are executed with the privileges of the user running the job.

Comment from JPCERT/CC

We are submitting the report again as we have yet to receive any responses from you after submitting it on February 5 and March 11.

It would be greatly appreciated if you could send us a message after confirming it so that we can follow up the case by email.

Summary

MONAI vulnerable to OS command injection.

Details

This library concatenates user-controlled values (YAML's "dataset_name_or_id" or part of "CLI/kwargs") without quoting or validation. Since this string is passed to subprocess with shell=True, shell metacharacters (e.g., Windows: & / Linux: ;) are interpreted.

As a result, arbitrary commands can be concatenated and executed. Therefore, the reporter identifies this as CWE-78 (OS Command Injection).

The victim needs to load a crafted YAML file in the code that launches training/validation jobs based on the configuration (YAML/arguments). There are no other constraints.

PoC

Verified on Windows. Load a modified YAML file with crafted "dataset_name_or_id" as follows. Add command separator characters (such as & or ;) and insert arbitrary commands.

dataset_name_or_id: '4 & echo "This is exploited" > "C:\Users\shima\OneDrive\Desktop\tmp\test.txt" & rem' dataroot: C:/Users/shima/OneDrive/Desktop/tmp/data datalist: C:/Users/shima/OneDrive/Desktop/tmp/lists/task4.json work_dir: C:/Users/shima/OneDrive/Desktop/tmp/work nnunet_raw: C:/Users/shima/OneDrive/Desktop/tmp/nnUNet_raw nnunet_preprocessed: C:/Users/shima/OneDrive/Desktop/tmp/nnUNet_preprocessed nnunet_results: C:/Users/shima/OneDrive/Desktop/tmp/nnUNet_results

As a victim, verify running the following Python code to load and process the YAML file.

from monai.apps.nnunet.nnunetv2_runner import nnUNetV2Runner from pathlib import Path #Path of the crafted YAML file YAML = r"C:\Users\shima\OneDrive\Desktop\tmp\test.yaml" #Text file overwritten when command executes OUT = Path(r"C:\Users\shima\OneDrive\Desktop\tmp\test.txt") #Read YAML runner = nnUNetV2Runner(input_config=YAML, trainer_class_name="nnUNetTrainer") runner.train_single_model(config="3d_fullres", fold=0, gpu_id=0) #Verify command execution print("Result:", OUT.read_text(encoding="utf-8").strip())

Also, see the attached file. JVN#50379904-details.zip

MONAI before 1.6.0 is vulnerable to OS command injection in the nnUNetV2Runner component (monai.apps.nnunet.nnunetv2_runner). User-controlled values taken from the YAML configuration file (notably dataset_name_or_id) and from CLI/kwargs arguments are concatenated into a command string without quoting or validation and then passed to subprocess with shell=True, so shell metacharacters (e.g., ';' on Linux, '&' on Windows) are interpreted. If a victim loads and processes a crafted configuration file — for example by instantiating nnUNetV2Runner with the malicious YAML and invoking a training/validation job such as train_single_model() — arbitrary commands are executed with the privileges of the user running the job.