What is the CVSS score of CVE-2026-24217?

CVE-2026-24217 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of NVIDIA BioNeMo Framework are affected by CVE-2026-24217?

NVIDIA BioNeMo Core for Linux contains a remote code execution vulnerability that could enable attackers to breach data confidentiality, manipulate information, or disrupt services through malicious…

How to fix or mitigate CVE-2026-24217?

24 hours: Inventory all systems running NVIDIA BioNeMo Core; classify by production criticality and data sensitivity. 7 days: Implement strict file input validation and restrict file sources to trusted channels only; isolate affected systems from untrusted networks where feasible. 30 days: Monitor NVIDIA security advisories for patch release; conduct formal risk assessment on continued deployment; evaluate alternative bioinformatics platforms if patching timeline becomes unacceptable.

NVIDIA BioNeMo Framework CVE-2026-24217

EUVD-2026-31144 HIGH

Path Traversal: '\\..\\filename' (CWE-29)

2026-05-20 nvidia

GHSA-3wq4-xjpf-pj4j

Information Disclosure RCE Denial Of Service Nvidia Path Traversal

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 20, 2026 - 20:01 vuln.today

DescriptionCVE.org

NVIDIA BioNeMo Core for Linux contains a vulnerability where a user could cause a path traversal by loading a malicious file. A successful exploit of this vulnerability might lead to code execution, denial of service, information disclosure, and data tampering.

AnalysisAI

Path traversal in NVIDIA BioNeMo Core for Linux allows remote attackers to escape intended directory boundaries when a user is induced to load a malicious file, enabling code execution, information disclosure, data tampering, or denial of service. The flaw carries a high CVSS score of 8.8 driven by network reachability and full CIA impact, though exploitation requires user interaction; no public exploit identified at time of analysis.

Technical ContextAI

BioNeMo is NVIDIA's framework for generative AI in drug discovery and computational biology, providing pretrained models and pipelines for molecular and protein workflows on GPU-accelerated Linux systems. The vulnerability is classified as CWE-29 (Path Traversal: '\..\filename'), indicating that file-path inputs supplied during model or asset loading are not sufficiently sanitized against parent-directory traversal sequences. When the framework deserializes or extracts content from an attacker-controlled file (for example a model checkpoint, archive, or configuration), traversal characters in embedded paths can cause writes or reads outside the intended working directory, which on a typical ML host with elevated runtime privileges translates to arbitrary file overwrite and resulting code execution.

RemediationAI

Patch available per vendor advisory - consult NVIDIA security bulletin 5831 at https://nvidia.custhelp.com/app/answers/detail/a_id/5831 for the exact fixed BioNeMo Framework release and upgrade affected Linux installations accordingly; exact fix versions are not included in the provided input data and must be taken from that advisory. Until the upgrade is applied, restrict the framework to loading model checkpoints, archives, and configuration files only from trusted, integrity-verified sources (internal artifact registries or signed NVIDIA NGC containers), and avoid importing community models from untrusted repositories or email attachments - the trade-off is operational friction for researchers who rely on rapidly iterating on third-party models. As an additional containment control, run BioNeMo workloads inside an unprivileged container with a read-only root filesystem and a narrowly scoped writable working directory, which limits the blast radius of any traversal write at the cost of breaking workflows that legitimately write outside the working directory.