NVIDIA NeMo Framework
Moderate fix1 remedy
cpe:2.3:a:nvidia:nemo:*:*:*:*:*:*:*
Moderate fix1 remedy
- < 2.3.2
NVIDIA NeMo Library Code Injection Vulnerability Leading to Remote Code Execution
Vulnerability
Patched
A code injection vulnerability has been identified in the NVIDIA NeMo library for all platforms, specifically within the model loading component. This issue allows an attacker to inject malicious code by loading .nemo files that contain carefully crafted metadata. Exploiting this vulnerability could result in remote code execution and unauthorized data modification.
Impact
Successful exploitation allows for remote code execution and data tampering.
Remediation
Users are advised to upgrade to the latest version of the NVIDIA NeMo Framework, version 2.3.2 or later. This update is available on the NVIDIA GitHub Releases page.
Added: Aug 13, 2025, 9:43 PM
Updated: Aug 13, 2025, 9:43 PM
Vulnerability Rating
Custom Algorithm
spread
2.4impact
5.0exploitability
4.7remediation
7.7relevance
0.3threat
0.0urgency
2.9incentive
1.7Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.