NVIDIA Merlin Transformers4Rec Code Injection Vulnerability Allowing Code Execution and Privilege Escalation

A code injection vulnerability has been identified in NVIDIA Merlin Transformers4Rec, affecting all platforms. This issue arises from a vulnerability in a Python dependency, which an attacker could exploit to inject malicious code. Successful exploitation may lead to unauthorized code execution, escalation of privileges, information disclosure, and data tampering.

Impact

Exploitation of this vulnerability could result in unauthorized code execution, elevated privileges, disclosure of sensitive information, and unauthorized modification of data.

Remediation

Users are advised to update to any version of NVIDIA Merlin Transformers4Rec that includes the GitHub commit b7eaea5. For more information, visit the NVIDIA Product Security page.