Advisory · CVE-2026-100844
MONAI training runner lets config files execute shell commands
The nnUNetV2Runner concatenates user-controlled config values into a shell command, so a crafted YAML runs arbitrary commands as the training user.
- Vendor
- Project-MONAI
- Product
- MONAI
- Identifier / CWE
- CVE-2026-100844
CWE-78 - Action timing
- Immediate
Explain it like I’m five
MONAI copies words from a recipe card straight into a spoken order to the kitchen. If the card says 'pasta; burn the kitchen', the kitchen hears both parts.
- 01Crafted config supplied
An attacker crafts a YAML configuration with shell metacharacters in dataset_name_or_id or CLI/kwargs arguments.
- 02Runner loads the config
The victim instantiates nnUNetV2Runner with the malicious YAML and starts a training or validation job.
- 03Values concatenated unquoted
User-controlled values are concatenated into a command string without quoting or validation, then passed to subprocess with shell=True.
- 04Commands execute
Shell metacharacters such as ; on Linux or & on Windows are interpreted, executing arbitrary commands as the user running the job.
What happened
MONAI before 1.6.0 (CVE-2026-100844, CVSS 8.6) is vulnerable to OS command injection in the nnUNetV2Runner component (monai/apps/nnunet/nnunetv2_runner.py). User-controlled values taken from the YAML configuration file (notably dataset_name_or_id) and from CLI or keyword arguments are concatenated into a command string without quoting or validation, then passed to subprocess with shell=True.
If a victim loads and processes a crafted configuration file, for example by instantiating nnUNetV2Runner with the malicious YAML and invoking a training or validation job such as train_single_model(), arbitrary commands execute with the privileges of the user running the job. Version 1.6.0 fixes the issue.
What to do
- Upgrade MONAI to 1.6.0 or later.
- Treat training configs from shared repositories, collaborators, or downloads as untrusted input until upgraded.
- Review training hosts for unexpected commands or processes launched around config-driven jobs.
- Inventory where nnUNet jobs run with elevated privileges and narrow that down.
Management note
Config files that drive shell execution are code by another name. Training hosts often hold data and credentials worth protecting; this is the config that hands them over.