NVIDIA NeMo Framework Code Injection Vulnerability in NLP Component

A code injection vulnerability has been identified in the NVIDIA NeMo Framework's NLP component, affecting all platforms. This issue allows an attacker to inject malicious data, which could be exploited to execute arbitrary code, escalate privileges, disclose sensitive information, and tamper with data. The vulnerability arises from improper control over code generation, enabling injected data to be executed as code.

Impact

Exploitation of this vulnerability could lead to unauthorized code execution, privilege escalation, information disclosure, and data manipulation.

Remediation

Users are advised to upgrade to NVIDIA NeMo Framework version 2.4.0 or later. The latest version can be downloaded from the NVIDIA GitHub releases page or via PyPI.