A code injection vulnerability in NVIDIA NeMo Curator allows authenticated local attackers to execute arbitrary code and compromise system integrity.

This vulnerability is a code injection flaw (CWE-94) that occurs when the application improperly processes malicious files. Based on the CVSS vector (PR:L), this requires a local user with low privileges to trigger the execution.

Successful exploitation of this flaw poses a severe risk to organizational data and system availability. With a CVSS score of 7.8, the vulnerability permits full system impact, including unauthorized data access, modification, and potential lateral movement within the environment.

Immediate Action: Update NVIDIA NeMo Curator to version 25.07 or later as mandated by the vendor security advisory.

Proactive Monitoring: Review system and application logs for unexpected file handling activities or unauthorized process execution associated with the NeMo Curator environment.

Compensating Controls: Restrict file system permissions to ensure that only authorized users can place files in directories processed by NeMo Curator, thereby limiting the potential attack surface.

Public Exploit Available: Unknown.

Given the potential for code execution and privilege escalation, this vulnerability must be treated with high priority. IT administrators should verify their current version of NeMo Curator and apply the 25.07 update immediately to prevent potential exploitation.