EUVD-2026-37130
GHSA-j4c5-f359-2237
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local host access and an existing low-privileged account are needed to plant the malicious artifact (AV:L, PR:L); deserialization yields full code execution under the loading user, so C/I/A all High.
Primary rating from Vendor (nvidia).
CVSS VectorVendor: nvidia
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
NVIDIA NeMo Framework for Linux contains a vulnerability where an attacker may cause deserialization of untrusted data. A successful exploit of this vulnerability may lead to code execution, escalation of privileges, data tampering, and information disclosure.
AnalysisAI
Local code execution in NVIDIA NeMo Framework on Linux allows an authenticated low-privileged attacker to abuse unsafe deserialization of untrusted data (CWE-502) to run arbitrary code, escalate privileges, tamper with data, or disclose information. The CVSS 7.8 (AV:L/PR:L) profile and the typical ML-training use case mean exploitation requires existing access to the host running NeMo. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Attacker must already have local low-privileged access (CVSS PR:L, AV:L) to a Linux host running NVIDIA NeMo Framework, and must be able to place a crafted serialized artifact - model checkpoint, cached object, or configuration file - in a filesystem location that the NeMo Framework subsequently deserializes during model loading, training start-up, or experiment configuration. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H scores 7.8 (High): impact is full CIA compromise but the attack vector is local and requires some pre-existing low-privileged access, which materially limits opportunistic exploitation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | On a shared GPU training host, a low-privileged researcher uploads a malicious model checkpoint or YAML/pickle config into a path that another user's NeMo training job, or a service-account pipeline, subsequently loads. When NeMo deserializes the crafted artifact the embedded gadget executes arbitrary code under the victim account, giving the attacker that user's data, credentials, and any group privileges - including potential root if a privileged operator account loads the artifact. … |
| Remediation | Patch available per vendor advisory - upgrade NVIDIA NeMo Framework to the fixed version listed in NVIDIA security bulletin 5839 at https://nvidia.custhelp.com/app/answers/detail/a_id/5839 (the exact fix version was not included in the supplied input and should be read directly from that advisory before deployment). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all NeMo Framework deployments and identify systems accessible to low-privileged users. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More from same product – last 7 days
Share
External POC / Exploit Code
Leaving vuln.today