CVE-2026-24155: NVIDIA NeMo Framework Code Injection Vulnerability (CVSS 7.8)

Technical summary

CVE-2026-24155 is a CWE-94 (Improper Control of Generation of Code) vulnerability affecting NVIDIA NeMo Framework across all platforms. The flaw permits code injection attacks through local vector, requiring low privileges and no user interaction. The CVSS 3.1 score of 7.8 (HIGH) reflects high impact across confidentiality, integrity, and availability dimensions. The attack surface is local, making it exploitable by authenticated users or processes running with basic user-level permissions on systems where NeMo is installed.

Business impact

Organizations using NVIDIA NeMo for machine learning operations face material risk of unauthorized code execution within their ML pipelines. This could lead to theft of proprietary models, training data exfiltration, poisoning of training datasets, or lateral movement within infrastructure. The vulnerability is particularly concerning for research institutions and enterprises managing sensitive AI workloads, as compromise may go undetected during model training phases. Remediation delays could expose ongoing projects to persistent threats.

Affected systems

NVIDIA NeMo Framework is affected across all platforms, including Linux, Windows, and cloud-based deployments. Any system running NeMo for model training, fine-tuning, or inference is potentially vulnerable. This includes development workstations, training clusters, and production inference servers. The vulnerability requires local access, so affected systems are primarily those where developers, ML engineers, or automated ML pipelines have accounts or where batch jobs execute with standard user privileges.

Exploitability

The vulnerability is exploitable by local attackers with standard user privileges, meaning any account on a system running NeMo can attempt exploitation. No user interaction is required—exploitation can be fully automated. However, the attack requires local access; remote exploitation is not possible through this vector alone. The relative simplicity of code injection attacks suggests weaponization is feasible once the specific vulnerable code path is identified. The fact that it is not yet listed in CISA's Known Exploited Vulnerabilities catalog does not indicate low risk.

Remediation

Organizations should prioritize patching all NeMo installations to the latest fixed version issued by NVIDIA. Verify the specific patched version number against NVIDIA's official advisory and release notes. For systems where patching cannot be immediately deployed, implement local access controls by restricting NeMo usage to trusted user accounts, disabling unnecessary execution paths, and isolating NeMo environments from broader network access. Monitor for suspicious local process execution originating from NeMo components.

Patch guidance

Check NVIDIA's official NeMo GitHub repository and security advisories for the patched version that addresses CVE-2026-24155. Apply updates to all instances of NeMo, including development machines, CI/CD pipelines, and production inference clusters. Test patches in non-production environments first to ensure compatibility with existing models and workflows. Once patches are available and verified, deploy systematically, prioritizing production systems and shared ML infrastructure.

Detection guidance

Monitor local process execution on systems running NeMo for unusual child processes spawned by NeMo components or Python interpreters associated with NeMo jobs. Log and alert on attempted execution of unexpected commands within NeMo's working directories. Implement filesystem integrity monitoring on NeMo installation directories to detect modifications. Review local user accounts and privileged access to NeMo environments; audit who has accounts on systems running NeMo and what their access levels are. Consider code scanning tools that detect unsafe code injection patterns in NeMo configurations or plugins.

Why prioritize this

This vulnerability should be prioritized due to its HIGH severity score, local exploitability by unprivileged users, and potential for complete system compromise within ML environments. The lack of user interaction required and the ubiquity of NeMo in AI/ML research and production settings elevate risk. While not yet publicly weaponized in the known exploit database, code injection vulnerabilities are well-understood attack primitives, and the impact—code execution with privilege escalation potential—is severe. Organizations running NeMo should treat patching as urgent.

Risk score, explained

The CVSS 3.1 score of 7.8 reflects a HIGH severity rating driven by local attack vector, low privilege requirement, and high impact across all three security properties: confidentiality (data theft), integrity (code modification), and availability (system disruption). The score appropriately captures that while the attack requires local access and standard user privileges, successful exploitation enables near-total compromise of the affected system and any data or models it processes.

Frequently asked questions