NVIDIA NeMo Framework Code Injection Vulnerability in BERT Services Component

A code injection vulnerability has been identified in the BERT services component of the NVIDIA NeMo Framework, affecting all platforms. This vulnerability allows an attacker to inject malicious data, which could be exploited to execute arbitrary code, escalate privileges, disclose sensitive information, and tamper with data. The issue arises from improper control of code generation, enabling attackers to manipulate the execution flow of the application.

Impact

Exploitation of this vulnerability could lead to unauthorized code execution, privilege escalation, information disclosure, and data tampering.

Remediation

Users are advised to update to version 2.5.0 or later. The update is available on the NVIDIA GitHub releases page and through the Python Package Index (PyPI).