Nemo
CVE-2025-33250
HIGH
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Code injection prevention, sandbox exec
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | CVSS 7.8 (HIGH). Attack vector: Local. Complexity: Low. Privileges required: Low. User interaction: None. Exploitable via remote/network. |
| Exploit ScenarioDerived | A remote attacker could exploit this vulnerability to compromise the affected system. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
NVIDIA NeMo Framework contains a vulnerability where an attacker could cause remote code execution. A successful exploit of this vulnerability might lead to code execution, denial of service, information disclosure, and data tampering. [CVSS 7.8 HIGH]
RemediationAI
Monitor vendor advisories for a patch.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Classified as CWE-94 (Code Injection). Affects Nemo. NVIDIA NeMo Framework contains a vulnerability where an attacker could cause remote code execution. A successful exploit of this vulnerability might lead to code execution, denial of service, information disclosure, and data tampering.
Know when Nemo gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
NVIDIA NeMo Framework contains a vulnerability where an attacker could cause remote code execution. A successful exploit of this vulnerability might lead to code execution, denial of service, information disclosure, and data tampering.
Executive ViewAI
CVE-2025-33250 affects NVIDIA NeMo Framework and allows remote attackers to execute arbitrary code with a 7.8 HIGH severity rating. Organizations using NeMo for AI/ML operations face immediate risk of data breach, system compromise, and operational disruption, with no vendor patch currently available to remediate the threat.
Implement network segmentation restricting NeMo Framework access to authorized internal networks only; disable external API exposure and remote model serving endpoints; deploy WAF rules to block suspicious payloads targeting NeMo services; enforce strict input validation on all NeMo API calls; implement runtime monitoring and behavioral analysis to detect exploitation attempts; restrict user privileges on systems running NeMo to principle of least privilege; consider temporarily disabling NeMo services in non-critical environments until patch availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)CVE.org
NVIDIA NeMo Framework for all platforms contains a vulnerability where a user could cause a deserialization of untrusted
NVIDIA NeMo Framework contains a vulnerability where malicious data could cause remote code execution. A successful expl
NVIDIA NeMo Framework contains a vulnerability where a user could cause a deserialization of untrusted data by remote co
NVIDIA NeMo Framework contains a vulnerability where an attacker could cause remote code execution in distributed enviro
NVIDIA NeMo Framework contains a vulnerability where an attacker could cause remote code execution. A successful exploit
NVIDIA NeMo Framework contains a vulnerability where an attacker could cause remote code execution by loading a maliciou
NVIDIA NeMo library for all platforms contains a vulnerability in the model loading component, where an attacker could c
NVIDIA NeMo Framework contains a vulnerability where an attacker could cause remote code execution. A successful exploit
NVIDIA NeMo Framework contains a vulnerability where an attacker could cause remote code execution by convincing a user
NVIDIA NeMo Framework for all platforms contains a vulnerability in the NLP and LLM components, where malicious data cre
NVIDIA NeMo Framework for all platforms contains a vulnerability in the bert services component where malicious data cre
NVIDIA NeMo Framework for all platforms contains a vulnerability in a script, where malicious input created by an attack
GitHub PoC
Exploit-DB