Skip to content

Fix Zip Slip vulnerability in NGC private bundle download #8682

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
KumoLiu merged 4 commits into from
Jan 5, 2026
Merged

Fix Zip Slip vulnerability in NGC private bundle download #8682

Changes from 2 commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
78ac8c3
Fix Zip Slip vulnerability in NGC private bundle download
yueyueL Jan 4, 2026
af6c053
[pre-commit.ci] auto fixes from pre-commit.com hooks
pre-commit-ci[bot] Jan 4, 2026
4daa3d3
style: fix isort import order
yueyueL Jan 5, 2026
0bb3592
Merge branch 'dev' into dev
KumoLiu Jan 5, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 3 additions & 6 deletions monai/bundle/scripts.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,6 @@
import re
import urllib
import warnings
import zipfile
from collections.abc import Mapping, Sequence
from functools import partial
from pathlib import Path
Expand All @@ -30,7 +29,7 @@
from torch.cuda import is_available

from monai._version import get_versions
from monai.apps.utils import _basename, download_url, extractall, get_logger
from monai.apps.utils import _basename, download_url, extractall, get_logger, _extract_zip
from monai.bundle.config_parser import ConfigParser
from monai.bundle.utils import DEFAULT_INFERENCE, DEFAULT_METADATA, merge_kv
from monai.bundle.workflows import BundleWorkflow, ConfigWorkflow
Expand Down Expand Up @@ -288,10 +287,8 @@ def _download_from_ngc_private(
if remove_prefix:
filename = _remove_ngc_prefix(filename, prefix=remove_prefix)
extract_path = download_path / f"{filename}"
with zipfile.ZipFile(zip_path, "r") as z:
z.extractall(extract_path)
logger.info(f"Writing into directory: {extract_path}.")

_extract_zip(zip_path, extract_path)
logger.info(f"Writing into directory: {extract_path}.")

def _get_ngc_token(api_key, retry=0):
"""Try to connect to NGC."""
Expand Down
Loading