NVIDIA NeMo Framework Remote Code Execution Vulnerability

A remote code execution vulnerability has been identified in NVIDIA NeMo Framework, affecting all versions prior to 2.6.2. This vulnerability arises from the deserialization of untrusted data, which could be exploited to execute arbitrary code. Successful exploitation may also lead to unauthorized privilege escalation, disclosure of sensitive information, and unauthorized modification of data.

Impact

Exploitation of this vulnerability allows for remote code execution, with potential consequences including unauthorized access to elevated privileges, leakage of confidential information, and unauthorized alterations to data.

Remediation

Users are advised to update to version 2.6.2 or later. The updated version is available on the NVIDIA GitHub repository and through the Python Package Index (PyPI).