Summary
MONAI contains an OS command injection vulnerability in the nnUNetV2Runner component because user-controlled configuration and argument values are incorporated into shell commands without adequate validation or quoting. If a victim loads a crafted YAML configuration or supplies malicious runner arguments and starts a training or validation job, arbitrary commands may execute with the privileges of the job-running user.
Affected context
The vulnerability occurs in MONAI deployments that use the nnUNetV2Runner component to start nnUNetV2 training or validation workflows. It is relevant when values such as dataset identifiers originate from YAML configuration files, command-line arguments, or keyword arguments and are subsequently used to construct shell commands through a shell-enabled subprocess invocation.
Exploit preconditions
- Attack surface: nnUNetV2Runner command execution during training or validation jobs
- Required access: Ability to provide or influence the YAML configuration, CLI arguments, or keyword arguments consumed by the runner
- Trigger point: Invocation of a workflow such as model training or validation
- Why exploitation is possible: User-controlled values are concatenated into a command string and interpreted by a shell without sufficient validation or safe argument handling
Why this happens
The underlying flaw is the construction of operating-system commands from untrusted strings followed by execution through a shell-enabled subprocess interface. Shell metacharacters embedded in attacker-controlled values can alter command interpretation, which maps to CWE-78: Improper Neutralization of Special Elements used in an OS Command. The insecure pattern treats data fields as part of executable shell syntax rather than as strictly separated command arguments.
Potential impact
- Arbitrary commands may execute under the job user's account
- Training or validation environments could be compromised
- Local datasets, credentials, or configuration secrets could be accessed
- Results or models may be modified, corrupted, or poisoned
- The compromised process could be used for further access where its privileges permit
General mitigation guidance
Mitigation generally focuses on eliminating shell interpretation and reducing trust in configuration-derived values.
Common defensive patterns include:
- Passing commands and arguments as structured argument arrays rather than concatenated shell strings
- Avoiding shell-enabled subprocess execution unless it is strictly necessary
- Applying allowlist validation and canonicalization to dataset identifiers and other command parameters
- Enforcing typed schemas and rejecting unexpected configuration values before job execution
- Restricting the privileges, filesystem access, network access, and secrets available to training jobs
- Treating externally supplied YAML and CLI inputs as untrusted, even when they are used in internal workflows
How teams detect issues like this
Detection approaches can include:
- Static analysis rules for shell-enabled subprocess calls and string concatenation involving process arguments
- Code review checks for YAML, CLI, or keyword-argument values flowing into command construction
- Tests using boundary and metacharacter-like input to verify that values remain single arguments
- Runtime monitoring for unexpected child processes, command interpreters, or anomalous process trees
- Policy enforcement requiring approved subprocess wrappers and structured argument handling
- Automated security review tools that identify command-injection data flows during development
