NVIDIA BioNeMo Framework is vulnerable to a path traversal attack that may allow unauthorized access to files outside of the intended directory.

This is a CWE-29 path traversal vulnerability. The application fails to properly sanitize user-supplied input when loading files, allowing an attacker to escape the intended directory and access sensitive files on the host system.

A path traversal vulnerability can lead to the exposure of sensitive configuration files, credentials, or system data, depending on the privileges of the application process. With a CVSS score of 8.8, this presents a severe risk of information disclosure and potential system compromise, which could have significant impacts on data confidentiality and integrity.

Immediate Action: Update the NVIDIA BioNeMo Framework to the latest version or apply the specific fix identified by commit dfd83a7.

Proactive Monitoring: Monitor file access logs and application logs for suspicious directory traversal strings (e.g., ../../) in file-loading operations.

Compensating Controls: Run the application in a restricted containerized environment with a read-only filesystem where possible, and ensure the process runs with the lowest necessary system privileges.

Public Exploit Available: Unknown

This vulnerability represents a significant security risk due to the potential for unauthorized file access. Organizations using the BioNeMo Framework should audit their current implementation and apply the vendor-provided updates or code fixes as soon as possible to prevent potential exploitation.