CVE-2026-100844: MONAI before 1.6.0 OS Command Injection via dataset_name_or_id
MONAI before 1.6.0 is vulnerable to OS command injection in the nnUNetV2Runner component (monai.apps.nnunet.nnunetv2runner). User-controlled values taken from the YAML configuration file (notably datasetnameorid) and from CLI/kwargs arguments are concatenated into a command string without quoting or validation and then passed to subprocess with shell=True, so shell metacharacters (e.g., ';' on Linux, '&' on Windows) are interpreted. If a victim loads and processes a crafted configuration file — for example by instantiating nnUNetV2Runner with the malicious YAML and invoking a training/validation job such as trainsinglemodel() — arbitrary commands are executed with the privileges of the user running the job.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MONAIto a version that resolves this vulnerability.Fixed in 1.6.0
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Users running MONAI's nnUNetV2Runner are exposed if they load YAML configuration files or supply CLI/kwargs values from untrusted sources and then run training or validation jobs. The impact is command execution with the privileges of the account running the job.
What must an attacker control to exploit it?
An attacker needs to provide a crafted YAML configuration or influence CLI/kwargs arguments used by nnUNetV2Runner. Values such as dataset_name_or_id can include shell metacharacters that are interpreted when the constructed command is executed.
Are deployments affected by default?
The provided information identifies the affected component as monai.apps.nnunet.nnunetv2_runner and requires processing attacker-controlled configuration or arguments. It does not establish that ordinary MONAI installations are exploitable without use of nnUNetV2Runner and untrusted input.
What can be done if updating is not immediately possible?
Do not load untrusted YAML files or pass untrusted values through CLI/kwargs to nnUNetV2Runner, especially dataset_name_or_id. Run training and validation jobs with least-privileged accounts to reduce the impact if malicious input is processed.
How can I tell whether a workflow is affected?
Check whether it uses nnUNetV2Runner and invokes jobs such as train_single_model() or validation after loading YAML configuration or accepting CLI/kwargs input. MONAI versions before 1.6.0 are affected according to the provided data.