NVIDIA NeMo Framework Vulnerable to High-Severity Command Injection Flaws

NVIDIA disclosed three high-severity vulnerabilities in the NeMo Framework, tracked as CVE-2026-24155, CVE-2026-24252, and CVE-2026-24228, each with a CVSS score of 7.8. The vulnerabilities affect all platforms, with CVE-2026-24252 specifically impacting Linux deployments, allowing OS command injection. Attackers with low privileges and local access can exploit these flaws to execute system commands, manipulate data, and escalate privileges. Affected versions include NeMo up to 2.7.2, with a patched release, NeMo 2.7.3, now available. There are currently no reports of active exploitation of these vulnerabilities. The vulnerabilities stem from improper handling of user-controlled input and unsafe deserialization of untrusted data. Security teams are advised to update to the patched version to mitigate risks.

Key Points: • NVIDIA disclosed three high-severity vulnerabilities in the NeMo Framework. • The vulnerabilities allow command injection and privilege escalation on affected systems. • A patched version, NeMo 2.7.3, is available, and users are urged to update.