NVIDIA Merlin Transformers4Rec Code Injection Vulnerability Allowing Privilege Escalation and Code Execution

A code injection vulnerability has been identified in NVIDIA Merlin Transformers4Rec, affecting all platforms. This vulnerability allows an attacker to inject malicious code, which could be executed, potentially leading to unauthorized code execution, escalation of privileges, information disclosure, and data tampering.

Impact

Exploitation of this vulnerability could result in unauthorized code execution, elevated privileges, disclosure of sensitive information, and unauthorized modification of data.

Remediation

Users are advised to update to any code branch that includes commit 27ddd49. The updated version can be found in the NVIDIA-Merlin/Transformers4Rec repository on GitHub.