gha-lab-733c168b88

Automated research artifact — not the upstream project. This repository is a disposable lab built by an automated harness for a master's thesis at Université Laval on reproducing published GitHub Actions workflow vulnerabilities. It is a verbatim snapshot of MIC-DKFZ/nnUNet at commit...

WS-2026-0033

MONAI is vulnerable to OS command injection in monai/apps/nnunet/nnunetv2runner.py. The runner concatenates user-controlled values from a configuration YAML datasetnameorid or CLI kwargs into a command string without quoting or validation, and the string is passed to subprocess with shell=True, s...

Command Injection

Overview monai is an AI Toolkit for Healthcare Imaging Affected versions of this package are vulnerable to Command Injection via the datasetnameorid parameter in monai/apps/nnunet/nnunetv2runner.py. When constructing shell commands for nnUNet training, the runner incorporates the user-supplied...

cmb (>=0.0.2, <=0.0.7), dbsegment (0.2.2) +11 more potentially affected by CVE-2026-44246 via nnunet (1.7.1)

nnunet PYPI version 1.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on nnunet and may be impacted: - cmb =0.0.2, =1.0.1b2023032102, =1.5.0, =1.0.0, =0.0.13, =2.2.6, =0.0.1a0, =0.0.1a0, =0.1.0, =0.1.1 Source cves: CVE-2026-44246 Source advisory:...

Improper Neutralization of Input Used for LLM Prompting

Overview nnunet is a nnU-Net. Framework for out-of-the box biomedical image segmentation. Affected versions of this package are vulnerable to Improper Neutralization of Input Used for LLM Prompting via the .github/workflows/issue-triage.yml process. An attacker can manipulate authenticated issue...