CVE-2025-23361: Nvidia Nemo Framework RCE Vulnerability

CVE-2025-23361 Overview

CVE-2025-23361 is a code injection vulnerability affecting the NVIDIA NeMo Framework across all supported platforms. The flaw resides in a script that fails to properly control code generation when processing attacker-supplied input. A local authenticated attacker who supplies crafted input can trigger arbitrary code execution within the context of the NeMo Framework process.

Successful exploitation may lead to code execution, privilege escalation, information disclosure, and data tampering. The vulnerability is tracked under CWE-94: Improper Control of Generation of Code.

Critical Impact
Local attackers with low privileges can achieve code execution and compromise the confidentiality, integrity, and availability of systems running vulnerable versions of the NVIDIA NeMo Framework.

Affected Products

NVIDIA NeMo Framework (all platforms)
Windows deployments of NVIDIA NeMo
Linux deployments of NVIDIA NeMo

Discovery Timeline

2025-11-11 - CVE-2025-23361 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-23361

Vulnerability Analysis

The vulnerability exists in a script within the NVIDIA NeMo Framework that processes input without adequately restricting how that input influences generated code. When an attacker supplies malicious input, the script incorporates that input into a code path that is subsequently interpreted or executed. This allows the attacker to inject and run arbitrary instructions within the framework's runtime context.

Because NeMo is used for training and deploying generative AI models, exploited environments often contain sensitive training data, model weights, and API credentials. Code execution in this context extends beyond the immediate process and threatens the broader machine learning pipeline.

Root Cause

The root cause is improper control of code generation, categorized as CWE-94. The affected script constructs or evaluates code based on attacker-influenced input without sufficient sanitization or safe evaluation boundaries. This weakness permits injected payloads to be treated as executable logic rather than inert data.

Attack Vector

Exploitation requires local access and low privileges on a system running the NeMo Framework. No user interaction is needed. An attacker with a foothold on a shared training host, a compromised developer workstation, or a multi-tenant ML environment can pass crafted input to the vulnerable script and gain elevated execution.

The attack surface is particularly relevant in shared research environments, CI/CD pipelines that invoke NeMo scripts, and container images that expose NeMo functionality to less-privileged accounts. See the NVIDIA Support Advisory for vendor-specific exploitation context.

Detection Methods for CVE-2025-23361

Indicators of Compromise

Unexpected child processes spawned from Python interpreters executing NeMo Framework scripts.
Anomalous outbound network connections initiated by NeMo processes to non-NVIDIA or non-repository endpoints.
Modifications to model checkpoints, tokenizer files, or training configuration files outside of scheduled training runs.

Detection Strategies

Monitor process ancestry for NeMo scripts spawning shells (/bin/sh, bash, cmd.exe, powershell.exe) or scripting interpreters not part of normal training workflows.
Enable Python audit hooks (sys.addaudithook) to log calls to exec, eval, compile, and os.system within NeMo runtime environments.
Correlate file integrity monitoring alerts on NeMo installation directories with user session activity to identify unauthorized script modification.

Monitoring Recommendations

Ingest host telemetry from ML training hosts into a centralized data lake and alert on privilege changes originating from NeMo processes.
Baseline expected command-line arguments for NeMo scripts and alert on deviations that include shell metacharacters or encoded payloads.
Track user access to NeMo configuration and script directories, and flag writes from accounts outside the ML engineering group.

How to Mitigate CVE-2025-23361

Immediate Actions Required

Apply the patched NeMo Framework release as identified in the NVIDIA Support Advisory (Answer ID 5718).
Restrict local access to hosts running NeMo to trusted operators and service accounts only.
Audit existing NeMo deployments for unauthorized script modifications or unexpected scheduled tasks.

Patch Information

NVIDIA has published remediation guidance in security bulletin Answer ID 5718. Administrators should upgrade to the fixed NeMo Framework version referenced in the advisory. Verify the installed version after upgrade and rebuild any container images that bundle NeMo to ensure fixed binaries propagate to production.

Workarounds

Run NeMo Framework processes under dedicated, low-privilege service accounts with no write access to sensitive directories.
Isolate NeMo workloads in containers or virtual machines with strict seccomp and AppArmor or SELinux profiles that block unexpected process execution.
Remove or restrict execute permissions on the affected script for users who do not require it, pending patch deployment.

bash

# Configuration example: restrict script execution to a dedicated group
sudo groupadd nemo-operators
sudo chown root:nemo-operators /opt/nemo/scripts/
sudo chmod 750 /opt/nemo/scripts/
sudo usermod -aG nemo-operators <trusted_user>