EUVD-2026-66098
GHSA-vr2c-6x8r-mc27
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged local Linux account
-
DeliveryInvoke NemoClaw status or logs plugin command
-
ExploitInject OS metacharacters into command argument
-
ExecutionShell interprets injected payload
-
PersistExecute arbitrary code with NemoClaw process privileges
-
ImpactExfiltrate data, tamper files, or disrupt service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The attacker must have an authenticated local user account on the Linux host running NemoClaw (CVSS PR:L confirms low-privilege local access is sufficient). The vulnerability is specifically triggered through the status and logs plugin commands - only these command interfaces are confirmed as entry points in the description. No additional elevated privileges, network access, or user interaction is required (UI:N). Exploitation is limited by the requirement for a pre-existing local account; remote unauthenticated exploitation is not supported by the AV:L vector. The scope does not change (S:U), meaning the attacker's impact is bounded to the NemoClaw process and its accessible resources on that host. |
| Impact | The CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) places this as a significant local privilege-escalation-class vulnerability: exploitation requires only a low-privileged local account, no interaction, and succeeds at low complexity. There is no EPSS score provided in the input, no CISA KEV listing, and no public POC reported, which collectively suggest this has not yet seen widespread exploitation. The scope is unschanged (S:U), so blast radius is contained to the vulnerable system - the attacker does not gain cross-system scope. Real-world risk is elevated in shared Linux environments (HPC clusters, multi-tenant AI workstations) where multiple lower-privileged users can invoke NemoClaw CLI tooling, but reduced in single-user or tightly access-controlled deployments. CVSS and description are consistent - local access is genuinely required, not a discrepancy. |
| Exploit ScenarioDerived | An attacker with a low-privileged local account on a Linux system running NemoClaw invokes a status or logs plugin command with crafted input containing shell metacharacters (e.g., a semicolon followed by an arbitrary command), causing the application to pass the injected command to the OS shell interpreter. The injected command executes with the privileges of the NemoClaw process, enabling the attacker to read sensitive files, modify application data, or disrupt service. No public POC exists at time of analysis, but the CWE-78 class is well-understood and exploitation techniques for OS command injection are widely published. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 25, 2026
OS command injection in NVIDIA NemoClaw for Linux allows a local low-privileged attacker to execute arbitrary operating system commands through the application's status and logs plugin command interfaces. The CVSS 7.8 score reflects high impact across confidentiality, integrity, and availability with low attack complexity and no user interaction required. No public exploit identified at time of analysis, and no CISA KEV listing observed, but the fully unscopeed local impact makes this a meaningful risk on multi-tenant or shared Linux systems running NemoClaw.
RemediationAI
Consult NVIDIA's official product security advisory at https://github.com/NVIDIA/product-security/tree/main/2026/5872 for patch availability and exact fixed version details - no specific patched release version was confirmed in the available input data. Until a patch is applied, restrict access to the NemoClaw CLI to only trusted, minimal-privilege accounts, as the vulnerability resides in the status and logs plugin commands specifically. Where feasible, run NemoClaw in an isolated Linux user namespace or container with no shell access to the host, reducing the blast radius of command injection. Audit existing NemoClaw deployments for unauthorized local user accounts that could exploit this vector. Do not expose NemoClaw command interfaces to shared or untrusted users pending remediation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-78 (Improper Neutralization of Special Elements used in an OS Command) indicates that user-supplied input passed to the status and logs plugin commands is not properly sanitized before being interpreted by the underlying OS shell. NVIDIA NemoClaw is a Linux-hosted AI framework tool; the affected CPE cpe:2.3:a:nvidia:nemoclaw:*:*:*:*:*:* covers all versions. The plugin command interface exposes a shell execution pathway where metacharacters (e.g., semicolons, pipes, backticks) in attacker-controlled arguments can break out of the intended command context and inject arbitrary shell instructions, a classic CWE-78 pattern in CLI tooling.
Know when Nemoclaw gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local-only attack via CLI plugin commands requiring a low-privilege account; no UI or network access needed; full C/I/A impact within the unscopped vulnerable system.
Primary rating from Vendor (nvidia).
CVSS VectorVendor: nvidia
DescriptionCVE.org
NVIDIA NemoClaw for Linux contains a vulnerability in its status and logs plugin commands, where an attacker could cause OS command injection. A successful exploit of this vulnerability might lead to code execution, data tampering, information disclosure, and denial of service.
Articles & Coverage 1
Executive ViewAI
NVIDIA NemoClaw for Linux contains a local OS command injection vulnerability (CVSS 7.8) in its status and logs plugin interfaces that allows low-privileged local attackers to execute arbitrary commands with full impact on confidentiality, integrity, and availability. No public exploit identified at time of analysis. This poses significant risk to organizations operating shared or multi-tenant Linux environments where NemoClaw is deployed. With no vendor patch currently available, immediate compensating controls and access restrictions are required to reduce exposure.
No vendor-released patch identified at time of analysis. Interim mitigations include: restrict plugin command interface access via role-based access controls to trusted administrators, implement host-based monitoring and alerting on NemoClaw process execution and system command activity, enforce principle of least privilege on user and service accounts running NemoClaw, isolate NemoClaw systems on segmented networks with controlled ingress, and disable or restrict status and logs plugin functionality if operationally feasible until patch availability is confirmed.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Weak authentication in NVIDIA NemoClaw for Linux (versions 0 through 0.0.4) lets remote attackers bypass the authenticat
Improper certificate validation in NVIDIA NemoClaw for Linux (versions up to and including 0.0.1) allows network attacke
Untrusted code execution in NVIDIA NemoClaw for Linux (versions up to and including 0.0.21) stems from the installer exe
Unverified code download in NVIDIA NemoClaw installation scripts for Linux (versions 0.0.0 through 0.0.21) allows a netw
Remote unauthenticated attackers can exfiltrate sensitive host environment variables from NVIDIA NeMoClaw by injecting m
Unauthenticated access to the NVIDIA NemoClaw inference server on Linux exposes sensitive model inference data and enabl
OS command injection in NVIDIA NemoClaw's NIM management component on Linux enables a local authenticated attacker to ex
OS command injection in NVIDIA NemoClaw's command-line interface on Linux enables a local low-privileged attacker to exe
OS command injection in NVIDIA NemoClaw's Telegram bridge component on Linux enables a local attacker with low-privilege
Code injection in NVIDIA NemoClaw's migration command (Linux, versions up to 0.0.17) allows a local attacker with low-pr
Server-side request forgery in NVIDIA NemoClaw's validateEndpointUrl() function allows local attackers with user interac
Credential exposure in NVIDIA NemoClaw allows a local low-privileged user, upon triggering user interaction, to access i
Exploit-DB