MONAI versions prior to 1.6.0 allow an attacker to inject arbitrary operating‑system commands through the nnUNetV2Runner component. The vulnerability arises because a user‑controlled YAML configuration entry, dataset_name_or_id, and additional command line arguments are concatenated into a shell command string without quoting or validation and then executed with subprocess shell=True. When a malicious configuration file is loaded and a training or validation job is run, any shell metacharacter supplied by the attacker is interpreted by the underlying operating system, allowing execution of arbitrary code with the privileges of the user running the job.

Affected systems include any installation of Project‑MONAI MONAI software using a version prior to 1.6.0. The vulnerable component is nnUNetV2Runner located in monai.apps.nnunet.nnunetv2_runner. Only versions before 1.6.0 are impacted; later releases contain the fix.

The CVSS score of 8.6 indicates a high severity. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog. The vulnerability requires an attacker to supply a crafted configuration file or manipulated CLI/kwargs arguments, which typically implies access to the local machine or the ability to influence the job configuration. Because the flaw results in a command‑line shell injection, an attacker who can deploy the malicious YAML will be able to execute commands with the job’s user privileges. The attack vector is thus likely local but could be extended if configuration files are obtained by remote code or through insecure file upload mechanisms.