Command Injection Affecting monai package, versions [,1.6.0)
Threat Intelligence
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-PYTHON-MONAI-18960425
- published19 Aug 2026
- disclosed18 Aug 2026
- creditUnknown
Introduced: 18 Aug 2026
New CVE NOT AVAILABLE CWE-78 (opens in a new tab)How to fix?
Upgrade monai to version 1.6.0 or higher.
Overview
monai is an AI Toolkit for Healthcare Imaging
Affected versions of this package are vulnerable to Command Injection via the dataset_name_or_id parameter in monai/apps/nnunet/nnunetv2_runner.py. When constructing shell commands for nnUNet training, the runner incorporates the user-supplied dataset_name_or_id value directly into subprocess command strings without validation. An attacker who controls this input can inject arbitrary shell commands that are executed with the privileges of the running process.