{"id":"CVE-2026-100844","aliases":["EUVD-2026-87844","GHSA-rghg-q7wp-9767","GHSA-x7wh-49x3-6748","PYSEC-2026-4019"],"status":"published","title":"MONAI before 1.6.0 OS Command Injection via dataset_name_or_id","description":"MONAI before 1.6.0 is vulnerable to OS command injection in the nnUNetV2Runner component (monai.apps.nnunet.nnunetv2_runner). User-controlled values taken from the YAML configuration file (notably dataset_name_or_id) and from CLI/kwargs arguments are concatenated into a command string without quoting or validation and then passed to subprocess with shell=True, so shell metacharacters (e.g., ';' on Linux, '\u0026' on Windows) are interpreted. If a victim loads and processes a crafted configuration file — for example by instantiating nnUNetV2Runner with the malicious YAML and invoking a training/validation job such as train_single_model() — arbitrary commands are executed with the privileges of the user running the job.","severity":{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00922,"percentile":0.60766,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-78"],"published":"2026-08-18T20:22:38Z","modified":"2026-10-28T02:30:45Z","fixes":[{"ecosystem":"PyPI","package":"monai","fixed_in":["1.6.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"monai","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.0"}]}]},{"source":"osv","ecosystem":"PyPI","package":"monai","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.0"}]}],"versions":["0.0.1","0.1.0","0.2.0","0.3.0","0.4.0","0.5.0","0.5.1","0.5.2","0.5.3","0.6.0","0.7.0","0.8.0","0.8.1","0.9.0","0.9.1","1.0.0","1.0.1","1.1.0","1.2.0","1.3.0","1.3.1","1.3.2","1.3.2rc1","1.3.3rc1","1.4.0","1.4.0rc1","1.4.0rc10","1.4.0rc11","1.4.0rc12","1.4.0rc2","1.4.0rc3","1.4.0rc4","1.4.0rc5","1.4.0rc6","1.4.0rc7","1.4.0rc8","1.4.0rc9","1.4.1rc1","1.5.0","1.5.0rc1","1.5.1","1.5.2","1.5.2rc1"]},{"source":"osv","ecosystem":"PyPI","package":"monai","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.0"}]}],"versions":["0.0.1","0.1.0","0.2.0","0.3.0","0.4.0","0.5.0","0.5.1","0.5.2","0.5.3","0.6.0","0.7.0","0.8.0","0.8.1","0.9.0","0.9.1","1.0.0","1.0.1","1.1.0","1.2.0","1.3.0","1.3.1","1.3.2","1.3.2rc1","1.3.3rc1","1.4.0","1.4.0rc1","1.4.0rc10","1.4.0rc11","1.4.0rc12","1.4.0rc2","1.4.0rc3","1.4.0rc4","1.4.0rc5","1.4.0rc6","1.4.0rc7","1.4.0rc8","1.4.0rc9","1.4.1rc1","1.5.0","1.5.0rc1","1.5.1","1.5.2","1.5.2rc1"]}],"products":[{"vendor":"project-monai","product":"monai"}],"references":[{"url":"https://github.com/Project-MONAI/MONAI/security/advisories/GHSA-rghg-q7wp-9767","tags":["vendor-advisory","exploit","Exploit","Vendor Advisory","advisory","web","evidence"]},{"url":"https://www.vulncheck.com/advisories/monai-before-1.6.0-os-command-injection-via-dataset-name-or-id","tags":["third-party-advisory","Third Party Advisory","advisory"]},{"url":"https://github.com/Project-MONAI/MONAI/pull/8885","tags":["web"]},{"url":"https://github.com/Project-MONAI/MONAI/releases/tag/1.6.0","tags":["web"]},{"url":"https://github.com/advisories/GHSA-rghg-q7wp-9767"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100844","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-x7wh-49x3-6748"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/100xxx/CVE-2026-100844.json","tags":["advisory"]},{"url":"https://github.com/Project-MONAI/MONAI","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-100844","title":"MONAI before 1.6.0 OS Command Injection via dataset_name_or_id","description":"MONAI before 1.6.0 is vulnerable to OS command injection in the nnUNetV2Runner component (monai.apps.nnunet.nnunetv2_runner). User-controlled values taken from the YAML configuration file (notably dataset_name_or_id) and from CLI/kwargs arguments are concatenated into a command string without quoting or validation and then passed to subprocess with shell=True, so shell metacharacters (e.g., ';' on Linux, '\u0026' on Windows) are interpreted. If a victim loads and processes a crafted configuration file — for example by instantiating nnUNetV2Runner with the malicious YAML and invoking a training/validation job such as train_single_model() — arbitrary commands are executed with the privileges of the user running the job.","status":"published","published":"2026-09-27T01:28:39.672Z","modified":"2026-10-08T15:22:02.046Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"},{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:20:06.925367Z"}],"euvd":[{"id":"EUVD-2026-87844","description":"MONAI before 1.6.0 is vulnerable to OS command injection in the nnUNetV2Runner component (monai.apps.nnunet.nnunetv2_runner). User-controlled values taken from the YAML configuration file (notably dataset_name_or_id) and from CLI/kwargs arguments are concatenated into a command string without quoting or validation and then passed to subprocess with shell=True, so shell metacharacters (e.g., ';' on Linux, '\u0026' on Windows) are interpreted. If a victim loads and processes a crafted configuration file — for example by instantiating nnUNetV2Runner with the malicious YAML and invoking a training/validation job such as train_single_model() — arbitrary commands are executed with the privileges of the user running the job.","status":"published","published":"2026-09-27T01:28:39Z","modified":"2026-10-08T15:22:02Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T17:27:32.18003Z"}],"ghsa":[{"id":"GHSA-rghg-q7wp-9767","title":"MONAI vulnerable to OS command injection","description":"### Comment from JPCERT/CC\nWe are submitting the report again as we have yet to receive\nany responses from you after submitting it on February 5 and March 11.\n\nIt would be greatly appreciated if you could send us a message\nafter confirming it so that we can follow up the case by email.\n\n### Summary\nMONAI vulnerable to OS command injection.\n\n### Details\nThis library concatenates user-controlled values (YAML's\n\"dataset_name_or_id\" or part of \"CLI/kwargs\")\nwithout quoting or validation. Since this string is passed to subprocess\nwith shell=True,\nshell metacharacters (e.g., Windows: \u0026 / Linux: ;) are interpreted.\n\nAs a result, arbitrary commands can be concatenated and executed.\nTherefore, the reporter identifies this as CWE-78 (OS Command Injection).\n\nThe victim needs to load a crafted YAML file in the code that launches\ntraining/validation jobs\nbased on the configuration (YAML/arguments). There are no other constraints.\n\n### PoC\nVerified on Windows.\nLoad a modified YAML file with crafted \"dataset_name_or_id\" as follows.\nAdd command separator characters (such as \u0026 or ;) and insert arbitrary\ncommands.\n\ndataset_name_or_id: '4 \u0026 echo \"This is exploited\" \u003e\n\"C:\\Users\\shima\\OneDrive\\Desktop\\tmp\\test.txt\" \u0026 rem'\ndataroot: C:/Users/shima/OneDrive/Desktop/tmp/data\ndatalist: C:/Users/shima/OneDrive/Desktop/tmp/lists/task4.json\nwork_dir: C:/Users/shima/OneDrive/Desktop/tmp/work\nnnunet_raw: C:/Users/shima/OneDrive/Desktop/tmp/nnUNet_raw\nnnunet_preprocessed: C:/Users/shima/OneDrive/Desktop/tmp/nnUNet_preprocessed\nnnunet_results: C:/Users/shima/OneDrive/Desktop/tmp/nnUNet_results\n\nAs a victim, verify running the following Python code to load and\nprocess the YAML file.\n\nfrom monai.apps.nnunet.nnunetv2_runner import nnUNetV2Runner\nfrom pathlib import Path\n#Path of the crafted YAML file\nYAML = r\"C:\\Users\\shima\\OneDrive\\Desktop\\tmp\\test.yaml\"\n#Text file overwritten when command executes\nOUT  = Path(r\"C:\\Users\\shima\\OneDrive\\Desktop\\tmp\\test.txt\")\n#Read YAML\nrunner = nnUNetV2Runner(input_config=YAML,\ntrainer_class_name=\"nnUNetTrainer\")\nrunner.train_single_model(config=\"3d_fullres\", fold=0, gpu_id=0)\n#Verify command execution\nprint(\"Result:\", OUT.read_text(encoding=\"utf-8\").strip())\n\nAlso, see the attached file.\n[JVN#50379904-details.zip](https://github.com/user-attachments/files/26231614/JVN.50379904-details.zip)","status":"published","published":"2026-08-18T20:22:38Z","modified":"2026-08-18T20:22:40Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:41:03.602876Z"},{"id":"GHSA-x7wh-49x3-6748","title":"MONAI before 1.6.0 is vulnerable to OS command injection in the nnUNetV2Runner component (monai...","description":"MONAI before 1.6.0 is vulnerable to OS command injection in the nnUNetV2Runner component (monai.apps.nnunet.nnunetv2_runner). User-controlled values taken from the YAML configuration file (notably dataset_name_or_id) and from CLI/kwargs arguments are concatenated into a command string without quoting or validation and then passed to subprocess with shell=True, so shell metacharacters (e.g., ';' on Linux, '\u0026' on Windows) are interpreted. If a victim loads and processes a crafted configuration file — for example by instantiating nnUNetV2Runner with the malicious YAML and invoking a training/validation job such as train_single_model() — arbitrary commands are executed with the privileges of the user running the job.","status":"published","published":"2026-09-27T03:31:05Z","modified":"2026-09-27T03:31:12Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"},{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:12:30.689958Z"}],"nvd":[{"id":"CVE-2026-100844","description":"MONAI before 1.6.0 is vulnerable to OS command injection in the nnUNetV2Runner component (monai.apps.nnunet.nnunetv2_runner). User-controlled values taken from the YAML configuration file (notably dataset_name_or_id) and from CLI/kwargs arguments are concatenated into a command string without quoting or validation and then passed to subprocess with shell=True, so shell metacharacters (e.g., ';' on Linux, '\u0026' on Windows) are interpreted. If a victim loads and processes a crafted configuration file — for example by instantiating nnUNetV2Runner with the malicious YAML and invoking a training/validation job such as train_single_model() — arbitrary commands are executed with the privileges of the user running the job.","status":"published","published":"2026-09-27T02:17:22.993Z","modified":"2026-09-30T15:33:29.1Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:12:52.081323Z"}],"osv":[{"id":"CVE-2026-100844","title":"MONAI before 1.6.0 OS Command Injection via dataset_name_or_id","description":"MONAI before 1.6.0 is vulnerable to OS command injection in the nnUNetV2Runner component (monai.apps.nnunet.nnunetv2_runner). User-controlled values taken from the YAML configuration file (notably dataset_name_or_id) and from CLI/kwargs arguments are concatenated into a command string without quoting or validation and then passed to subprocess with shell=True, so shell metacharacters (e.g., ';' on Linux, '\u0026' on Windows) are interpreted. If a victim loads and processes a crafted configuration file — for example by instantiating nnUNetV2Runner with the malicious YAML and invoking a training/validation job such as train_single_model() — arbitrary commands are executed with the privileges of the user running the job.","status":"published","published":"2026-09-27T01:28:39.672Z","modified":"2026-10-28T02:30:45.805456288Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:44:53.83521Z"},{"id":"GHSA-rghg-q7wp-9767","title":"MONAI vulnerable to OS command injection","description":"### Comment from JPCERT/CC\nWe are submitting the report again as we have yet to receive\nany responses from you after submitting it on February 5 and March 11.\n\nIt would be greatly appreciated if you could send us a message\nafter confirming it so that we can follow up the case by email.\n\n### Summary\nMONAI vulnerable to OS command injection.\n\n### Details\nThis library concatenates user-controlled values (YAML's\n\"dataset_name_or_id\" or part of \"CLI/kwargs\")\nwithout quoting or validation. Since this string is passed to subprocess\nwith shell=True,\nshell metacharacters (e.g., Windows: \u0026 / Linux: ;) are interpreted.\n\nAs a result, arbitrary commands can be concatenated and executed.\nTherefore, the reporter identifies this as CWE-78 (OS Command Injection).\n\nThe victim needs to load a crafted YAML file in the code that launches\ntraining/validation jobs\nbased on the configuration (YAML/arguments). There are no other constraints.\n\n### PoC\nVerified on Windows.\nLoad a modified YAML file with crafted \"dataset_name_or_id\" as follows.\nAdd command separator characters (such as \u0026 or ;) and insert arbitrary\ncommands.\n\ndataset_name_or_id: '4 \u0026 echo \"This is exploited\" \u003e\n\"C:\\Users\\shima\\OneDrive\\Desktop\\tmp\\test.txt\" \u0026 rem'\ndataroot: C:/Users/shima/OneDrive/Desktop/tmp/data\ndatalist: C:/Users/shima/OneDrive/Desktop/tmp/lists/task4.json\nwork_dir: C:/Users/shima/OneDrive/Desktop/tmp/work\nnnunet_raw: C:/Users/shima/OneDrive/Desktop/tmp/nnUNet_raw\nnnunet_preprocessed: C:/Users/shima/OneDrive/Desktop/tmp/nnUNet_preprocessed\nnnunet_results: C:/Users/shima/OneDrive/Desktop/tmp/nnUNet_results\n\nAs a victim, verify running the following Python code to load and\nprocess the YAML file.\n\nfrom monai.apps.nnunet.nnunetv2_runner import nnUNetV2Runner\nfrom pathlib import Path\n#Path of the crafted YAML file\nYAML = r\"C:\\Users\\shima\\OneDrive\\Desktop\\tmp\\test.yaml\"\n#Text file overwritten when command executes\nOUT  = Path(r\"C:\\Users\\shima\\OneDrive\\Desktop\\tmp\\test.txt\")\n#Read YAML\nrunner = nnUNetV2Runner(input_config=YAML,\ntrainer_class_name=\"nnUNetTrainer\")\nrunner.train_single_model(config=\"3d_fullres\", fold=0, gpu_id=0)\n#Verify command execution\nprint(\"Result:\", OUT.read_text(encoding=\"utf-8\").strip())\n\nAlso, see the attached file.\n[JVN#50379904-details.zip](https://github.com/user-attachments/files/26231614/JVN.50379904-details.zip)","status":"published","published":"2026-08-18T20:22:38Z","modified":"2026-10-01T09:26:04.128653482Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:46:55.877614Z"},{"id":"PYSEC-2026-4019","description":"MONAI before 1.6.0 is vulnerable to OS command injection in the nnUNetV2Runner component (monai.apps.nnunet.nnunetv2_runner). User-controlled values taken from the YAML configuration file (notably dataset_name_or_id) and from CLI/kwargs arguments are concatenated into a command string without quoting or validation and then passed to subprocess with shell=True, so shell metacharacters (e.g., ';' on Linux, '\u0026' on Windows) are interpreted. If a victim loads and processes a crafted configuration file — for example by instantiating nnUNetV2Runner with the malicious YAML and invoking a training/validation job such as train_single_model() — arbitrary commands are executed with the privileges of the user running the job.","status":"published","published":"2026-09-27T02:17:22.993Z","modified":"2026-10-01T09:15:05.310406723Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:57.255153Z"}]}}