A critical code injection vulnerability in the NVIDIA NeMo Framework could allow a local attacker to achieve full system compromise, including code execution and privilege escalation.

This vulnerability is a code injection flaw (CWE-94) within the retrieval services component of the NeMo Framework. According to the CVSS vector (AV:L/PR:L), the attack requires a local, authenticated user to provide malicious data to the service to trigger the injection.

Successful exploitation allows an attacker to execute arbitrary code with the privileges of the application, potentially leading to total system compromise. Given the CVSS score of 7.8, this vulnerability poses a significant risk to data integrity, confidentiality, and availability within environments utilizing the NeMo Framework for AI and machine learning workflows.

Immediate Action: Update the NVIDIA NeMo Framework to version 2.4.0 or later as specified by the vendor security advisory.

Proactive Monitoring: Monitor system logs for unexpected process execution or abnormal activity originating from the retrieval services component.

Compensating Controls: Restrict local access to the server and ensure that only authorized users have the necessary permissions to interact with the NeMo Framework services.

Public Exploit Available: Unknown

Organizations using the NVIDIA NeMo Framework must prioritize the transition to version 2.4.0. Given the potential for code execution and privilege escalation, failure to patch could expose critical infrastructure to severe security breaches. Please coordinate with your IT operations team to apply the update during the next available maintenance window.