EUVD-2026-31144
GHSA-3wq4-xjpf-pj4j
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (nvidia) · only source for this CVE.
CVSS VectorVendor: nvidia
Lifecycle Timeline
1DescriptionCVE.org
NVIDIA BioNeMo Core for Linux contains a vulnerability where a user could cause a path traversal by loading a malicious file. A successful exploit of this vulnerability might lead to code execution, denial of service, information disclosure, and data tampering.
AnalysisAI
Path traversal in NVIDIA BioNeMo Core for Linux allows remote attackers to escape intended directory boundaries when a user is induced to load a malicious file, enabling code execution, information disclosure, data tampering, or denial of service. The flaw carries a high CVSS score of 8.8 driven by network reachability and full CIA impact, though exploitation requires user interaction; no public exploit identified at time of analysis.
Technical ContextAI
BioNeMo is NVIDIA's framework for generative AI in drug discovery and computational biology, providing pretrained models and pipelines for molecular and protein workflows on GPU-accelerated Linux systems. The vulnerability is classified as CWE-29 (Path Traversal: '\..\filename'), indicating that file-path inputs supplied during model or asset loading are not sufficiently sanitized against parent-directory traversal sequences. When the framework deserializes or extracts content from an attacker-controlled file (for example a model checkpoint, archive, or configuration), traversal characters in embedded paths can cause writes or reads outside the intended working directory, which on a typical ML host with elevated runtime privileges translates to arbitrary file overwrite and resulting code execution.
RemediationAI
Patch available per vendor advisory - consult NVIDIA security bulletin 5831 at https://nvidia.custhelp.com/app/answers/detail/a_id/5831 for the exact fixed BioNeMo Framework release and upgrade affected Linux installations accordingly; exact fix versions are not included in the provided input data and must be taken from that advisory. Until the upgrade is applied, restrict the framework to loading model checkpoints, archives, and configuration files only from trusted, integrity-verified sources (internal artifact registries or signed NVIDIA NGC containers), and avoid importing community models from untrusted repositories or email attachments - the trade-off is operational friction for researchers who rely on rapidly iterating on third-party models. As an additional containment control, run BioNeMo workloads inside an unprivileged container with a read-only root filesystem and a narrowly scoped writable working directory, which limits the blast radius of any traversal write at the cost of breaking workflows that legitimately write outside the working directory.
More in Bionemo Framework
View allInsecure deserialization in NVIDIA BioNeMo Framework enables remote code execution when attackers can induce users to pr
Deserialization of untrusted data in NVIDIA BioNeMo Framework enables local attackers to execute arbitrary code, cause d
Arbitrary code execution in NVIDIA BioNemo Framework on Linux allows a local attacker to abuse unsafe deserialization of
Same weakness CWE-29 – Path Traversal: '\\..\\filename'
View allShare
External POC / Exploit Code
Leaving vuln.today