OS Command Injection Vulnerability in MONAI

hello@craftedsignal.io — Tue, 18 Aug 2026 20:57:29 +0000

MONAI versions prior to 1.6.0 are susceptible to OS command injection due to insecure handling of user-controlled configuration parameters within YAML files. Specifically, parameters such as 'dataset_name_or_id' or various CLI arguments are concatenated into strings and processed by the subprocess module with shell=True. Because this input is not properly quoted or validated, an attacker can inject shell metacharacters - such as '&' on Windows or ';' on Linux - to escape the intended command context and execute arbitrary system instructions. This vulnerability (CWE-78) is triggered whenever a victim loads a malicious YAML configuration file into a training or validation pipeline. Defenders should prioritize updating the MONAI package to version 1.6.0 or later to mitigate the risk of remote code execution on systems running medical imaging training tasks.

Impact

Successful exploitation allows an attacker to execute arbitrary commands with the privileges of the user running the MONAI training or validation scripts. This can lead to full system compromise, exfiltration of sensitive medical imaging datasets, or the deployment of persistent malware on workstations and servers used for research and clinical analysis.

Recommendation

Update the MONAI package to version 1.6.0 or higher across all development and production environments.
Implement strict validation and input sanitization for any YAML configuration files used in machine learning pipelines.
Run training jobs under restricted service accounts with minimal filesystem and network permissions to limit the impact of potential command execution.
Monitor process creation logs for unusual child processes spawned by python.exe or python3, particularly those involving shell command separators.

MONAI (< 1.6.0) - CraftedSignal Threat Feed

OS Command Injection Vulnerability in MONAI

Impact

Recommendation