A critical code injection vulnerability in the NVIDIA NeMo Framework allows local attackers to execute arbitrary code and escalate privileges.

This vulnerability stems from the insecure deserialization of untrusted data (CWE-502). An attacker with local access can supply malicious data to the framework, resulting in arbitrary code execution, privilege escalation, information disclosure, and data tampering.

The potential for unauthorized code execution and privilege escalation poses a significant risk to the integrity and confidentiality of the host system. Given the CVSS score of 7.8, this vulnerability is classified as High severity, as it allows a local attacker to compromise the entire environment where the NeMo Framework is deployed.

Immediate Action: Upgrade the NVIDIA NeMo Framework to version 2.5.3 or later to apply the necessary security patches.

Proactive Monitoring: Monitor system logs for unusual process execution or unauthorized attempts to access sensitive directories associated with the NeMo Framework environment.

Compensating Controls: Restrict local access to the system hosting the NeMo Framework to authorized users only, as the attack vector requires local interaction.

Public Exploit Available: Unknown

The severity of this flaw, which enables code execution and privilege escalation, requires prompt attention. Administrators should prioritize updating the NVIDIA NeMo Framework to version 2.5.3 to eliminate the deserialization risk and secure the underlying host environment.