CVE-2025-33205
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
NVIDIA NeMo framework contains a vulnerability in a predefined variable, where an attacker could cause inclusion of functionality from an untrusted control sphere by use of a predefined variable. A successful exploit of this vulnerability may lead to code execution.
Risk Assessment
An attacker could execute arbitrary code in the context of an application using NVIDIA NeMo, potentially leading to system compromise or data leakage.
Recommendation
Update NVIDIA NeMo to the latest version and review predefined variable configurations for unsafe references.
Other vulnerabilities in NVIDIA NeMo
See all- CVE-2026-65179High
NVIDIA NeMo contains a vulnerability in the TabularTokenizer class where it deserializes an untrusted, attacker-controlled .pkl file via pickle.load() without validation. A successful exploit of this vulnerability may lead to code execution, data tampering, denial of service, and information disclosure.
- CVE-2026-65178High
NVIDIA NeMo contains a vulnerability in its dataset-loading workflow where a maliciously crafted model_config.yaml can inject unsafe parameters. A successful exploit of this vulnerability may lead to code execution, data tampering, denial of service, and information disclosure.
- CVE-2026-24252High
A vulnerability in NVIDIA NeMo for Linux allows an attacker to cause OS command injection, potentially leading to code execution, data tampering, privilege escalation, and information disclosure.
Original NVD description (English source)
NVIDIA NeMo framework contains a vulnerability in a predefined variable, where an attacker could cause inclusion of functionality from an untrusted control sphere by use of a predefined variable. A successful exploit of this vulnerability may lead to code execution.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS