NVIDIA has issued a essential safety replace addressing two high-severity vulnerabilities in its NeMo Framework that might permit attackers to execute malicious code and escalate privileges on affected techniques.
The vulnerabilities, tracked as CVE-2025-23361 and CVE-2025-33178, each carry a CVSS rating of seven.8 and have an effect on all variations of the NeMo Framework earlier than model 2.5.0 throughout all platforms.
NVIDIA NeMo Framework Vulnerabilities
The primary vulnerability, CVE-2025-23361, exists in a framework script, the place malicious enter from an attacker could trigger improper management over code technology.
The second flaw, CVE-2025-33178, resides within the Bert companies element and allows code injection via malicious knowledge.
Each vulnerabilities share the identical assault vector and require native entry with low privileges.
CVE IDDescriptionCVSS ScoreCWECVE-2025-23361Improper management of code technology in framework script7.8CWE-94CVE-2025-33178Code injection in bert companies component7.8CWE-94
Profitable exploitation may lead to code execution, privilege escalation, info disclosure, and knowledge manipulation, posing vital dangers to organizations utilizing the framework.
The vulnerabilities have been found and reported by safety researchers from TencentAISec and NISL lab at Tsinghua College, highlighting the significance of collaborative safety analysis.
All variations of the NVIDIA NeMo Framework earlier than 2.5.0 are susceptible, no matter working system or platform. Organizations utilizing earlier software program department releases are additionally in danger and will improve instantly.
NVIDIA recommends that customers clone or replace to the NeMo Framework model 2.5.0 or later, obtainable from the official NVIDIA GitHub repository and the PyPI package deal supervisor.
The corporate emphasizes that customers on earlier department releases ought to improve to the newest department model.
Organizations ought to assess their particular configurations and apply the safety replace promptly to mitigate potential exploitation dangers.
Observe us on Google Information, LinkedIn, and X for day by day cybersecurity updates. Contact us to characteristic your tales.
