21 matches found
CVE-2026-109361
MONAI 1.2.0 before 1.6.1 contains an insecure deserialization vulnerability in nnUNetV2Runner that unpickles the postprocessingfile path read from inferenceinformation.json without confining it to the results directory. Attackers who can modify inferenceinformation.json can point it at a maliciou...
CVE-2026-109361
The MONAI library (versions 1.2.0 before 1.6.1 ) is vulnerable to an insecure deserialization vulnerability within the nnUNetV2Runner component. The root cause is that the software unpickles the postprocessing_file path retrieved from inference_information.json without restricting it to the resul...
CVE-2026-109361 MONAI 1.2.0 before 1.6.1 Insecure Deserialization RCE via nnUNetV2Runner postprocessing_file Path
MONAI 1.2.0 before 1.6.1 contains an insecure deserialization vulnerability in nnUNetV2Runner that unpickles the postprocessingfile path read from inferenceinformation.json without confining it to the results directory. Attackers who can modify inferenceinformation.json can point it at a maliciou...
EUVD-2026-97663
MONAI 1.2.0 before 1.6.1 contains an insecure deserialization vulnerability in nnUNetV2Runner that unpickles the postprocessingfile path read from inferenceinformation.json without confining it to the results directory. Attackers who can modify inferenceinformation.json can point it at a maliciou...
CVE-2026-109361 MONAI 1.2.0 before 1.6.1 Insecure Deserialization RCE via nnUNetV2Runner postprocessing_file Path
MONAI 1.2.0 before 1.6.1 contains an insecure deserialization vulnerability in nnUNetV2Runner that unpickles the postprocessingfile path read from inferenceinformation.json without confining it to the results directory. Attackers who can modify inferenceinformation.json can point it at a maliciou...
CVE-2026-109361
MONAI 1.2.0 before 1.6.1 contains an insecure deserialization vulnerability in nnUNetV2Runner that unpickles the postprocessingfile path read from inferenceinformation.json without confining it to the results directory. Attackers who can modify inferenceinformation.json can point it at a maliciou...
CVE-2026-109361 MONAI 1.2.0 before 1.6.1 Insecure Deserialization RCE via nnUNetV2Runner postprocessing_file Path
MONAI 1.2.0 before 1.6.1 contains an insecure deserialization vulnerability in nnUNetV2Runner that unpickles the postprocessingfile path read from inferenceinformation.json without confining it to the results directory. Attackers who can modify inferenceinformation.json can point it at a maliciou...
PT-2026-110778
MONAI 1.2.0 before 1.6.1 contains an insecure deserialization vulnerability in nnUNetV2Runner that unpickles the postprocessing file path read from inference information.json without confining it to the results directory. Attackers who can modify inference information.json can point it at a...
CVE-2026-109361: Deserialization of Untrusted Data
MONAI 1.2.0 before 1.6.1 contains an insecure deserialization vulnerability in nnUNetV2Runner that unpickles the postprocessingfile path read from inferenceinformation.json without confining it to the results directory. Attackers who can modify inferenceinformation.json can point it at a maliciou...
CVE-2026-100844
MONAI before 1.6.0 is vulnerable to OS command injection in the nnUNetV2Runner component monai.apps.nnunet.nnunetv2runner. User-controlled values taken from the YAML configuration file notably datasetnameorid and from CLI/kwargs arguments are concatenated into a command string without quoting or...
PYSEC-2026-4019
MONAI before 1.6.0 is vulnerable to OS command injection in the nnUNetV2Runner component monai.apps.nnunet.nnunetv2runner. User-controlled values taken from the YAML configuration file notably datasetnameorid and from CLI/kwargs arguments are concatenated into a command string without quoting or...
PYSEC-2026-4019
MONAI before 1.6.0 is vulnerable to OS command injection in the nnUNetV2Runner component monai.apps.nnunet.nnunetv2runner. User-controlled values taken from the YAML configuration file notably datasetnameorid and from CLI/kwargs arguments are concatenated into a command string without quoting or...
CVE-2026-100844
MONAI before 1.6.0 is vulnerable to OS command injection in the nnUNetV2Runner component monai.apps.nnunet.nnunetv2runner. User-controlled values taken from the YAML configuration file notably datasetnameorid and from CLI/kwargs arguments are concatenated into a command string without quoting or...
CVE-2026-100844 MONAI before 1.6.0 OS Command Injection via dataset_name_or_id
MONAI before 1.6.0 is vulnerable to OS command injection in the nnUNetV2Runner component monai.apps.nnunet.nnunetv2runner. User-controlled values taken from the YAML configuration file notably datasetnameorid and from CLI/kwargs arguments are concatenated into a command string without quoting or...
EUVD-2026-87844
MONAI before 1.6.0 is vulnerable to OS command injection in the nnUNetV2Runner component monai.apps.nnunet.nnunetv2runner. User-controlled values taken from the YAML configuration file notably datasetnameorid and from CLI/kwargs arguments are concatenated into a command string without quoting or...
CVE-2026-100844 MONAI before 1.6.0 OS Command Injection via dataset_name_or_id
MONAI before 1.6.0 is vulnerable to OS command injection in the nnUNetV2Runner component monai.apps.nnunet.nnunetv2runner. User-controlled values taken from the YAML configuration file notably datasetnameorid and from CLI/kwargs arguments are concatenated into a command string without quoting or...
CVE-2026-100844 MONAI before 1.6.0 OS Command Injection via dataset_name_or_id
MONAI before 1.6.0 is vulnerable to OS command injection in the nnUNetV2Runner component monai.apps.nnunet.nnunetv2runner. User-controlled values taken from the YAML configuration file notably datasetnameorid and from CLI/kwargs arguments are concatenated into a command string without quoting or...
CVE-2026-100844
MONAI versions prior to 1.6.0 are vulnerable to an OS command injection flaw within the nnUNetV2Runner component (monai.apps.nnunet.nnunetv2_runner). The root cause is the insecure concatenation of user-controlled values from YAML configuration files (specifically dataset_name_or_id) and CLI/kwar...
PT-2026-105780
MONAI before 1.6.0 is vulnerable to OS command injection in the nnUNetV2Runner component monai.apps.nnunet.nnunetv2 runner. User-controlled values taken from the YAML configuration file notably dataset name or id and from CLI/kwargs arguments are concatenated into a command string without quoting...
CVE-2026-100844: Improper Neutralization of Special Elements used in an OS Command
MONAI before 1.6.0 is vulnerable to OS command injection in the nnUNetV2Runner component monai.apps.nnunet.nnunetv2runner. User-controlled values taken from the YAML configuration file notably datasetnameorid and from CLI/kwargs arguments are concatenated into a command string without quoting or...