NVIDIA NeMo Framework Code Injection Vulnerability Allowing Code Execution and Privilege Escalation

A code injection vulnerability has been identified in the NVIDIA NeMo Framework, affecting all platforms and versions prior to 2.5.0. This vulnerability allows attackers to manipulate code generation processes, potentially leading to unauthorized code execution, elevated privileges, information disclosure, and data tampering.

Impact

Exploitation of this vulnerability could result in unauthorized code execution, escalation of privileges, unauthorized information disclosure, and unauthorized data modification.

Remediation

Users are advised to update to version 2.5.0 or later. The updated version is available on the NVIDIA GitHub releases page and through the Python Package Index (PyPI).