NVIDIA Megatron-LM Code Injection Vulnerability in Ensemble Classifier Script Allowing Privilege Escalation and Data Manipulation

A code injection vulnerability has been identified in the ensemble_classifier script of NVIDIA Megatron-LM, affecting all platforms. This vulnerability allows an attacker to inject malicious data, which could be exploited to execute arbitrary code, escalate privileges, disclose sensitive information, and tamper with data.

Impact

Exploitation of this vulnerability could lead to unauthorized code execution, elevated privileges, unauthorized information access, and data manipulation.

Remediation

Users are advised to update to version 0.13.1 or 0.12.3 and later. The updated versions are available on the NVIDIA Megatron-LM GitHub releases page.