NVIDIA BioNeMo Framework Deserialization Vulnerability Leading to Code Execution and Data Compromise

A vulnerability in the NVIDIA BioNeMo Framework allows for the deserialization of untrusted data. Exploiting this vulnerability could result in unauthorized code execution, denial of service, information disclosure, and data tampering. This issue affects all versions of the BioNeMo Framework that do not include the security update referenced in this bulletin.

Impact

Exploitation of this vulnerability could lead to unauthorized code execution, disruption of service, unauthorized information access, and unauthorized modification of data.

Remediation

Users are advised to update to the latest version of the NVIDIA BioNeMo Framework that includes commit e5e58c8 or later. This update is available on the NVIDIA BioNeMo Framework GitHub repository.