{"action":"Upgrade monai to 1.6.0 or later.","affected":[{"fixed":"1.6.0","introduced":"0"}],"component":"monai","cve_ids":["CVE-2026-100844"],"ecosystem":"PyPI","epss":0.00922,"exploited":false,"fixed_versions":["1.6.0"],"ghsa_id":"GHSA-rghg-q7wp-9767","id":"tcs_01M5KH9A8PC774AJ0DPHFA6JCB","modified_at":"2026-10-01T09:15:05.310406723Z","published_at":"2026-09-27T02:17:22.993Z","references":["https://osv.dev/vulnerability/PYSEC-2026-4019","https://www.vulncheck.com/advisories/monai-before-1.6.0-os-command-injection-via-dataset-name-or-id","https://github.com/Project-MONAI/MONAI/security/advisories/GHSA-rghg-q7wp-9767"],"severity":{"label":"high","score":7.8},"sources":[{"source":"osv","source_id":"PYSEC-2026-4019","url":"https://osv.dev/vulnerability/PYSEC-2026-4019"}],"summary":"MONAI before 1.6.0 is vulnerable to OS command injection in the nnUNetV2Runner component (monai.apps.nnunet.nnunetv2_runner). User-controlled values taken from the YAML configuration file (notably dat"}