NVIDIA NeMo Framework Code Injection Vulnerability Allowing Arbitrary Code Execution and Privilege Escalation

A code injection vulnerability has been identified in NVIDIA NeMo Framework, affecting all platforms and versions prior to 2.5.3. This vulnerability allows malicious data created by an attacker to be injected, potentially leading to arbitrary code execution, escalation of privileges, unauthorized information disclosure, and data tampering.

Impact

Exploitation of this vulnerability could result in arbitrary code execution, unauthorized privilege escalation, information disclosure, and data tampering.

Remediation

Users are advised to update to version 2.5.3 or later. The updated version is available on the NVIDIA NeMo Framework GitHub releases page and on PyPI.