EUVD-2026-66099
GHSA-c97f-w3wc-9q4h
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain position on install code path (MITM/poisoned source)
-
DeliveryVictim runs NemoClaw installer
-
ExploitInstaller fetches code without integrity check
-
ExecutionSubstitute malicious payload
-
PersistPayload executes with installer privileges
-
ImpactFull host compromise / privilege escalation
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V15 - Secure Coding and Architecture Code integrity verification
|
| Exploitation Conditions | Exploitation targets the NemoClaw installation process specifically (versions ≤0.0.21): the attacker must be able to deliver untrusted code into that process - for example by controlling or MITM-ing the code/package source the installer fetches - because the installer performs no integrity check (CWE-494). Limiting factors: the window is confined to install/update time (an already-installed, static system is not continuously exposed via this flaw), the attacker generally needs a privileged network position or control of a trusted delivery source, and impact severity depends on the privileges under which the installer runs. Despite the CVSS PR:N/UI:N labeling, real-world abuse depends on a victim initiating installation and an attacker controlling the code delivery path. |
| Impact | The signals conflict and warrant scrutiny. The CVSS vector (AV:N/AC:L/PR:N/UI:N) implies trivial, fully remote, unauthenticated exploitation against default installs, and SSVC rates Technical Impact as 'total' - consistent with the CWE-494 total-compromise potential. However, the description explicitly scopes the flaw to the installation process, which realistically requires a victim to run the installer AND an attacker to be positioned to deliver malicious code (network MITM or a poisoned source), so the AC:L/UI:N portrayal likely overstates ease - verify the exact trigger with NVIDIA. Corroborating a lower real-world urgency: EPSS is only 0.25% (17th percentile), SSVC Exploitation is 'none', Automatable is 'no', and there is no KEV listing and no public POC. Net assessment: high theoretical impact but a bounded, opportunistic attack surface (install-time only), making this a patch-on-normal-cadence item rather than an emergency for already-installed systems - the primary exposure window is during (re)installation or updates. |
| Exploit ScenarioDerived | An attacker who can interpose on the network path or control a source the installer trusts substitutes malicious code for a legitimate component; because NemoClaw's installer does not verify integrity, the attacker's code executes during installation, typically with the installer's elevated privileges, yielding full host compromise. No public exploit is currently identified, and the attacker must catch a victim during an install or update. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 01, 2026
Untrusted code execution in NVIDIA NemoClaw for Linux (versions up to and including 0.0.21) stems from the installer executing code without verifying its integrity, letting an attacker who can supply or interpose malicious code during installation achieve arbitrary code execution, privilege escalation, data tampering, information disclosure, and denial of service. NVIDIA assigns a CVSS of 9.8 with a fully network-based, no-privilege, no-interaction vector, though the flaw is rooted in the install process. There is no public exploit identified at time of analysis, EPSS is low at 0.25% (17th percentile), and CISA SSVC records no known exploitation.
Earlier versions of this analysis (1)
NVIDIA NemoClaw for Linux exposes users to remote code execution during its installation process via a Download of Code Without Integrity Check flaw (CWE-494), scored CVSS 8.1. An unauthenticated attacker capable of intercepting network traffic between the installing host and NVIDIA's distribution infrastructure can substitute malicious code for legitimate installer components, achieving code execution, privilege escalation, data tampering, information disclosure, or denial of service. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the full C:H/I:H/A:H impact triad means successful exploitation is catastrophic if network-interception conditions are met.
RemediationAI
Upgrade NemoClaw to a release later than 0.0.21 as published in NVIDIA's advisory (https://github.com/NVIDIA/product-security/tree/main/2026/5872); the input confirms 0 through 0.0.21 are affected but does not state an exact fixed version, so treat the advisory as the source of the patched build - Patch available per vendor advisory, exact fixed version not independently confirmed here. Until patched, perform installations and updates only from trusted, authenticated channels: verify package checksums/signatures out-of-band before running the installer, install over TLS-protected transport, and avoid installing NemoClaw over untrusted or shared networks where a machine-in-the-middle could substitute code (trade-off: adds manual verification overhead and slows deployment). Restrict who can run the installer and run it in a controlled, monitored environment rather than as an ambient root process where feasible.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected product is NVIDIA NemoClaw, a Linux software package identified by cpe:2.3:a:nvidia:nemoclaw. The root cause is CWE-494 (Download of Code Without Integrity Check): the installation process fetches, loads, or executes code without cryptographically verifying its authenticity or integrity, so an attacker who controls the delivery path (e.g., a compromised mirror, package source, or a machine-in-the-middle position on the network) can substitute attacker-controlled code that then runs with the installer's privileges. Because installers on Linux commonly run with elevated or root privileges, the missing integrity check converts a supply/transport compromise into full host compromise, which is why NVIDIA rates the technical impact as total and lists impacts spanning code execution through denial of service.
Know when Nemoclaw gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Install-time CWE-494 realistically needs attacker-controlled code delivery (MITM/poisoned source, AC:H) and a victim running the installer (UI:R); successful compromise is total (C/I/A:H).
Primary rating from Vendor (nvidia).
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
NVIDIA NemoClaw for Linux contains a vulnerability in its installation process, where an attacker could cause execution of untrusted code. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, information disclosure, and denial of service.
Articles & Coverage 1
Executive ViewAI
NVIDIA NemoClaw for Linux (versions up to 0.0.21) contains an installer code execution vulnerability that allows attackers who control or intercept the installation process to achieve arbitrary code execution and full system compromise. Organizations deploying or updating this software should immediately restrict installations to trusted environments and halt new deployments until patches become available.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Verify installer integrity using official NVIDIA checksums or cryptographic signatures before any execution; (2) Execute all NemoClaw installations only on isolated, air-gapped networks to prevent supply-chain interception; (3) Implement strict access controls on installer packages and restrict which personnel can modify or distribute installation media; (4) Deploy network segmentation to limit lateral movement if any NemoClaw installation is compromised; (5) Defer any new NemoClaw deployments until a patch is released, tested, and deployed to all systems.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Weak authentication in NVIDIA NemoClaw for Linux (versions 0 through 0.0.4) lets remote attackers bypass the authenticat
Improper certificate validation in NVIDIA NemoClaw for Linux (versions up to and including 0.0.1) allows network attacke
Unverified code download in NVIDIA NemoClaw installation scripts for Linux (versions 0.0.0 through 0.0.21) allows a netw
Remote unauthenticated attackers can exfiltrate sensitive host environment variables from NVIDIA NeMoClaw by injecting m
Unauthenticated access to the NVIDIA NemoClaw inference server on Linux exposes sensitive model inference data and enabl
OS command injection in NVIDIA NemoClaw for Linux allows a local low-privileged attacker to execute arbitrary operating
OS command injection in NVIDIA NemoClaw's NIM management component on Linux enables a local authenticated attacker to ex
OS command injection in NVIDIA NemoClaw's command-line interface on Linux enables a local low-privileged attacker to exe
OS command injection in NVIDIA NemoClaw's Telegram bridge component on Linux enables a local attacker with low-privilege
Code injection in NVIDIA NemoClaw's migration command (Linux, versions up to 0.0.17) allows a local attacker with low-pr
Server-side request forgery in NVIDIA NemoClaw's validateEndpointUrl() function allows local attackers with user interac
Credential exposure in NVIDIA NemoClaw allows a local low-privileged user, upon triggering user interaction, to access i
Exploit-DB