NVIDIA NemoClaw CVE-2026-65099

Exploitation requires an interactive local session (or equivalent code execution) on a Linux system where NemoClaw is installed, with at minimum a low-privileged (non-root) OS user account - confirmed by the CVSS vector PR:L and AV:L. The vulnerable surface is the NemoClaw command-line interface specifically; the flaw does not appear exploitable remotely unless NemoClaw's CLI is exposed through a remote interface (e.g., a web wrapper or SSH with forced command), which is not indicated by available data. No user interaction by a second party is required (UI:N). Limiting factors: an attacker cannot exploit this remotely without prior foothold on the host; root or elevated privileges are not required to exploit but also not granted as a precondition. Deployment on isolated single-user workstations greatly limits realistic attacker opportunity.

The CVSS 7.8 score reflects a high-severity local exploitation scenario with low attack complexity and low privilege requirements, yielding full C/H/I/A impact. However, the local attack vector (AV:L) materially constrains real-world risk: an attacker must already have an interactive shell or equivalent access on the target Linux host. There is no EPSS score provided in the input data, and neither KEV status nor public POC availability is indicated, suggesting this has not yet seen broad attacker interest. For environments running NemoClaw on shared or multi-tenant Linux systems (e.g., HPC clusters, AI development servers), the risk is meaningful because co-resident low-privileged users could escalate to full code execution. On single-user or isolated workstations, the practical threat is substantially lower. The unchanged scope (S:U) means successful exploitation does not inherently pivot to adjacent systems, which limits lateral movement value. Overall: treat as a real priority on shared-access systems; deprioritize on isolated workstations pending a vendor patch.

A low-privileged local user on a shared Linux server (e.g., a shared AI development host) crafts a malicious CLI argument or input value containing shell metacharacters designed to escape the intended command context. When NemoClaw processes this input and passes it unsanitized to an OS command, the injected payload executes with the privileges of the NemoClaw process, potentially achieving privilege escalation or full data exfiltration. No public POC has been identified at time of analysis, but the simplicity of CWE-78 exploitation in CLI tools makes this reproducible with basic shell knowledge once the exact injection point is identified.