NVIDIA NeMo Framework Model Loading Vulnerability Allowing Code Execution and Privilege Escalation

A vulnerability has been identified in the NVIDIA NeMo Framework related to model loading. This issue could enable an attacker to exploit improper control mechanisms by having a user load a maliciously crafted file. Exploitation of this vulnerability could result in code execution, unauthorized privilege escalation, denial of service, and data tampering.

Impact

Exploitation of this vulnerability could lead to code execution, escalation of privileges, denial of service, and unauthorized data modification.

Remediation

Users are advised to update to version 2.5.3 or later. The updated version is available on the NVIDIA NeMo Framework GitHub releases page and through the Python Package Index (PyPI).