NVIDIA Megatron-LM Code Injection Vulnerability in MSDP Preprocessing Script Allowing Privilege Escalation and Data Manipulation

A code injection vulnerability has been identified in the NVIDIA Megatron-LM msdp preprocessing script, affecting all platforms. This vulnerability allows an attacker to inject malicious data, which could be exploited to execute arbitrary code, escalate privileges, disclose sensitive information, and tamper with data.

Impact

Exploitation of this vulnerability could lead to unauthorized code execution, elevated privileges, information leakage, and unauthorized data modification.

Remediation

Users are advised to update to version 0.13.1 or 0.12.3 and later. The updated versions are available on the NVIDIA Megatron-LM GitHub releases page.