NVIDIA Megatron-LM Code Injection Vulnerability Leading to Code Execution and Privilege Escalation

A code injection vulnerability has been identified in NVIDIA Megatron-LM for all platforms. This issue arises in a Python component, where an attacker can exploit the vulnerability by providing a malicious file. Successful exploitation may result in unauthorized code execution, elevated privileges, information disclosure, and data tampering.

Impact

Exploitation of this vulnerability allows for arbitrary code execution, unauthorized privilege escalation, and could lead to disclosure of sensitive information and unauthorized modification of data.

Remediation

Users are advised to update to version 0.12.1 or later. The update is available on the NVIDIA Megatron-LM GitHub Releases page.