NVIDIA NeMo Framework Code Injection Vulnerability in Export and Deploy Component

A code injection vulnerability has been identified in the NVIDIA NeMo Framework, affecting all platforms. The issue arises in the export and deploy component, where an attacker can introduce malicious data that may be executed as code. Exploitation of this vulnerability could lead to unauthorized code execution, elevated privileges, disclosure of sensitive information, and manipulation of data.

Impact

Exploitation of this vulnerability could result in code execution, privilege escalation, unauthorized information access, and data alteration.

Remediation

Users are advised to upgrade to NVIDIA NeMo Framework version 2.4.0 or later. The latest version can be downloaded from the NVIDIA GitHub releases page or via PyPI.