EUVD-2026-37130
GHSA-j4c5-f359-2237
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local host access and an existing low-privileged account are needed to plant the malicious artifact (AV:L, PR:L); deserialization yields full code execution under the loading user, so C/I/A all High.
Primary rating from Vendor (nvidia).
CVSS VectorVendor: nvidia
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
NVIDIA NeMo Framework for Linux contains a vulnerability where an attacker may cause deserialization of untrusted data. A successful exploit of this vulnerability may lead to code execution, escalation of privileges, data tampering, and information disclosure.
AnalysisAI
Local code execution in NVIDIA NeMo Framework on Linux allows an authenticated low-privileged attacker to abuse unsafe deserialization of untrusted data (CWE-502) to run arbitrary code, escalate privileges, tamper with data, or disclose information. The CVSS 7.8 (AV:L/PR:L) profile and the typical ML-training use case mean exploitation requires existing access to the host running NeMo. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Technical ContextAI
NVIDIA NeMo Framework is an open-source toolkit for building and training generative AI / large language and speech models, distributed primarily as a Python package and container image for Linux GPU hosts. The flaw is a CWE-502 Deserialization of Untrusted Data issue, the same root-cause class that has repeatedly affected ML frameworks loading attacker-controlled pickle/checkpoint/config artifacts (e.g. torch.load, YAML/pickle config loaders). Per the supplied CPE cpe:2.3:a:nvidia:nemo_framework:*:*:*:*:*:*:*:* the issue affects the NeMo Framework product across versions enumerated in NVIDIA's advisory; in practice the dangerous sink is reached when NeMo ingests a serialized object (model checkpoint, config, or cached artifact) that an attacker has placed in a path the framework reads.
RemediationAI
Patch available per vendor advisory - upgrade NVIDIA NeMo Framework to the fixed version listed in NVIDIA security bulletin 5839 at https://nvidia.custhelp.com/app/answers/detail/a_id/5839 (the exact fix version was not included in the supplied input and should be read directly from that advisory before deployment). Until the upgrade is rolled out, treat all model checkpoints, configs, and serialized artifacts loaded by NeMo as untrusted input: restrict write access to checkpoint and cache directories to a single trusted identity (trade-off: breaks shared-workspace workflows), refuse to load artifacts pulled from untrusted registries, model hubs, or user uploads, and isolate NeMo training jobs in per-user containers or namespaces so a successful deserialization gadget cannot pivot to another tenant (trade-off: added scheduling and storage overhead). Monitor for unexpected child processes spawned by NeMo Python workers as a detection backstop.
More in Nemo Framework
View allOS command injection in NVIDIA NeMo for Linux allows a local authenticated attacker to execute arbitrary commands, leadi
Code injection in NVIDIA NeMo Framework across all supported platforms allows a local attacker with low privileges to ex
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today