NVIDIA Merlin Transformers4Rec Deserialization Vulnerability in Trainer Component Allowing Code Execution

A deserialization vulnerability has been identified in the Trainer component of NVIDIA Merlin Transformers4Rec for Linux. This issue allows a user to manipulate the deserialization process, potentially leading to code execution, denial of service, information disclosure, and data tampering.

Impact

Exploitation of this vulnerability could result in unauthorized code execution, disruption of service, unauthorized information access, and unauthorized data modification.

Remediation

Users are advised to update to any code branch that includes commit 876f19e. For more information, visit the NVIDIA Product Security page.