CVE-2026-100844

Project-monai Monai: OS command injection

Risk score: 63/100
CVSS: 7.8 v3.1
Exploit chance (30 days): 0.8%
Published: 27 Sep 2026

Open in the live forecast Today's forecast

What to know

What it is: MONAI before 1.6.0 is vulnerable to OS command injection in the nnUNetV2Runner component (monai.apps.nnunet.nnunetv2_runner). User-controlled values taken from the YAML configuration file (notably dataset_name_or_id) and from CLI/kwargs arguments are concatenated into a command string without quoting or validation and…
Affected: Project-monai Monai before 1.6.0
Fix: Upgrade Project-monai Monai to 1.6.0 or later.
Exploitation: Public proof of concept

Story map

Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Project-monai Monai: Amber, patch this week. MONAI before 1.5.2 contains a deserialization of untrusted data vulnerability in the algo_from_pickle function in monai/auto3dseg/utils.py. The function reads a .pkl file and passes its contents to pickle.loads without validating the data source or content. If an application invokes algo_from_pickle on an attacker-sup…

The flaws

CVE-2026-100844: OS command injection (CVSS 7.8 · EPSS 1%)
CVE-2026-100846: Unsafe deserialisation can lead to remote code execution (CVSS 8.8 · EPSS 0%)
CVE-2026-100842: Remote code execution (CVSS 8.8 · EPSS 0%)
CVE-2026-100840: Remote code execution (CVSS 7.8 · EPSS 0%)

The fix

Upgrade Project-monai Monai: 1.6.0 · 1.5.2 or later on your release line

Who is exposed: Project-monai Monai before 1.5.2

Where it stands

Public proof of concept

Connects to

Same weakness: OS command injection (CWE-78). 308 other warnings in 30 days
Same product: Earlier Project-monai Monai warnings. 3 in the last 90 days

Why it is Amber

CVSS 7.8 high
Public exploit or proof of concept referenced

References

Original description

MONAI before 1.6.0 is vulnerable to OS command injection in the nnUNetV2Runner component (monai.apps.nnunet.nnunetv2_runner). User-controlled values taken from the YAML configuration file (notably dataset_name_or_id) and from CLI/kwargs arguments are concatenated into a command string without quoting or validation and then passed to subprocess with shell=True, so shell metacharacters (e.g., ';' on Linux, '&' on Windows) are interpreted. If a victim loads and processes a crafted configuration file — for example by instantiating nnUNetV2Runner with the malicious YAML and invoking a training/validation job such as train_single_model() — arbitrary commands are executed with the privileges of the user running the job.

Last activity 27 Sep 2026. Patch Forecast updates every hour.