Volerion logoVolerion
Volerion logoVolerion

NVIDIA NeMo Framework Predefined Variable Vulnerability Leading to Code Execution

Vulnerability

A vulnerability exists in the NVIDIA NeMo framework prior to version 2.5.1, where a predefined variable can be exploited to include functionality from an untrusted control sphere. This vulnerability could lead to unauthorized code execution.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the affected system.

Remediation

Users are advised to update to version 2.5.1 or later. The updated version is available on the NVIDIA NeMo GitHub repository and through the Python Package Index (PyPI).

Added: Nov 25, 2025, 6:20 PM
Updated: Nov 25, 2025, 10:40 PM

Vulnerability Rating

Custom Algorithm
spread
2.4
impact
10.0
exploitability
4.7
remediation
7.7
relevance
1.2
threat
0.0
urgency
2.9
incentive
1.7

Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.