NVIDIA NeMo AI Curator Facilitates Code Execution and Privilege Escalation
NVIDIA has issued a critical security bulletin regarding a high-severity vulnerability in its NeMo Curator platform, identified as CVE-2025-23307. This vulnerability affects all versions of NVIDIA NeMo Curator prior to release 25.07 across Windows, Linux, and macOS platforms. The flaw arises from improper input validation in the file processing mechanisms of NeMo Curator, allowing attackers to create malicious files that can trigger code injection attacks. With a CVSS v3.1 base score of 7.8, this vulnerability is classified as high severity, posing significant risks to enterprise AI infrastructure deployments. The vulnerability enables local code execution and privilege escalation, impacting the confidentiality, integrity, and availability of affected systems.
The vulnerability is categorised under CWE-94 (Code Injection), indicating that NeMo Curator fails to adequately sanitise user-supplied input when processing certain file types. The attack vector necessitates local access, low attack complexity, and low privileges, making it relatively accessible to attackers who have gained initial system access. Successful exploitation requires no user interaction and can lead to severe impacts, including complete system compromise, information disclosure, and data tampering. NVIDIA has released Curator version 25.07 to address this security issue, with updates available through the official NVIDIA GitHub repository. Organisations using earlier versions are strongly advised to upgrade to the latest available version to implement enhanced input validation mechanisms and file processing safeguards.
Categories: Security Vulnerability, Code Injection, Software Update
Tags: NVIDIA, NeMo Curator, CVE-2025-23307, Vulnerability, Code Injection, Privilege Escalation, Input Validation, Security Update, CVSS, Exploit