OS Command Injection Vulnerability in MONAI's nnUNetV2Runner Component

CVE-2026-100844

What is CVE-2026-100844?

The MONAI framework's nnUNetV2Runner component is susceptible to OS command injection due to insufficient validation of user-supplied values from the YAML configuration file. Specifically, when values such as dataset_name_or_id are utilized in command strings without proper quoting, attackers can introduce malicious commands. If a crafted configuration file is processed, particularly during model training or validation tasks, arbitrary commands can be executed with the permissions of the user, potentially leading to security breaches. It is critical for users to upgrade to MONAI version 1.6.0 or later to mitigate this vulnerability.

References