Nemo
CVE-2025-33246
HIGH
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Command injection prevention
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | CVSS 7.8 (HIGH). Attack vector: Local. Complexity: Low. Privileges required: Low. User interaction: None. |
| Exploit ScenarioDerived | An attacker could exploit this vulnerability to compromise the affected system. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
NVIDIA NeMo Framework for all platforms contains a vulnerability in the ASR Evaluator utility, where a user could cause a command injection by supplying crafted input to a configuration parameter. [CVSS 7.8 HIGH]
RemediationAI
Monitor vendor advisories for a patch.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Classified as CWE-77 (Command Injection). Affects Nemo. NVIDIA NeMo Framework for all platforms contains a vulnerability in the ASR Evaluator utility, where a user could cause a command injection by supplying crafted input to a configuration parameter. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, or information disclosure.
Know when Nemo gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
NVIDIA NeMo Framework for all platforms contains a vulnerability in the ASR Evaluator utility, where a user could cause a command injection by supplying crafted input to a configuration parameter. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, or information disclosure.
Executive ViewAI
NVIDIA NeMo Framework contains a command injection vulnerability affecting the ASR Evaluator utility that could allow attackers to execute arbitrary commands through malicious configuration inputs. Organizations using NeMo for speech recognition or audio processing workflows face risk of system compromise and data exposure until remediation is deployed.
Disable or isolate ASR Evaluator functionality if operationally feasible. Implement strict input validation and sanitization on all configuration parameters passed to the ASR Evaluator. Restrict network access to NeMo Framework components using firewall rules and network segmentation. Run NeMo processes with minimal privileges and in isolated containers. Monitor and log all ASR Evaluator configuration changes and execution. Implement application-level controls to prevent untrusted user input from reaching configuration parameters.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Affected Products (CPE)CVE.org
NVIDIA NeMo Framework for all platforms contains a vulnerability where a user could cause a deserialization of untrusted
NVIDIA NeMo Framework contains a vulnerability where malicious data could cause remote code execution. A successful expl
NVIDIA NeMo Framework contains a vulnerability where a user could cause a deserialization of untrusted data by remote co
NVIDIA NeMo Framework contains a vulnerability where an attacker could cause remote code execution in distributed enviro
NVIDIA NeMo Framework contains a vulnerability where an attacker could cause remote code execution. A successful exploit
NVIDIA NeMo Framework contains a vulnerability where an attacker could cause remote code execution by loading a maliciou
NVIDIA NeMo library for all platforms contains a vulnerability in the model loading component, where an attacker could c
NVIDIA NeMo Framework contains a vulnerability where an attacker could cause remote code execution. A successful exploit
NVIDIA NeMo Framework contains a vulnerability where an attacker could cause remote code execution. A successful exploit
NVIDIA NeMo Framework contains a vulnerability where an attacker could cause remote code execution by convincing a user
NVIDIA NeMo Framework for all platforms contains a vulnerability in the NLP and LLM components, where malicious data cre
NVIDIA NeMo Framework for all platforms contains a vulnerability in the bert services component where malicious data cre
GitHub PoC
Exploit-DB