NVIDIA NeMoClaw Improper Access Control Vulnerability Leading to Information Disclosure

A vulnerability exists in NVIDIA NeMoClaw within the sandbox environment initialization component. This issue allows remote attackers to cause improper access control by sending prompt-injected content that prompts the agent to read and exfiltrate host environment variables that were not properly restricted during the creation of the sandbox. Exploiting this vulnerability could result in unauthorized information disclosure.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive host environment variables, allowing for potential information disclosure.

Remediation

Users are advised to update to version 0.0.18 or later. The updated version can be downloaded from the NVIDIA NeMoClaw GitHub repository.