NVIDIA Megatron-LM Code Injection Vulnerability Allowing Arbitrary Code Execution and Privilege Escalation

A code injection vulnerability has been identified in NVIDIA Megatron-LM, all platforms, specifically within the megatron/training/arguments.py component. This vulnerability allows an attacker to inject malicious input, potentially leading to arbitrary code execution, escalation of privileges, unauthorized information disclosure, and data tampering.

Impact

Exploitation of this vulnerability could result in arbitrary code execution, unauthorized privilege escalation, information disclosure, and unauthorized data modification.

Remediation

Users are advised to update to version 0.12.2 or later. Instructions for downloading the latest version are available on the NVIDIA Megatron-LM GitHub Releases page.