CVE-2025-23361

NVIDIA NeMo Framework for all platforms contains a vulnerability in a script, where malicious input created by an attacker may cause improper control of code generation. A successful exploit of this vulnerability may lead to code execution, escalation of privileges, information disclosure, and data tampering.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://nvd.nist.gov/vuln/detail/CVE-2025-23361	Technical Description
https://nvidia.custhelp.com/app/answers/detail/a_id/5718	Vendor Advisory
https://www.cve.org/CVERecord?id=CVE-2025-23361	Technical Description

Configurations

Configuration 1 (hide)

cpe:2.3:a:nvidia:nemo:*:*:*:*:*:*:*:*

History

18 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) El NVIDIA NeMo Framework para todas las plataformas contiene una vulnerabilidad en un script, donde una entrada maliciosa creada por un atacante puede causar un control inadecuado de la generación de código. Un exploit exitoso de esta vulnerabilidad puede conducir a la ejecución de código, escalada de privilegios, revelación de información y manipulación de datos.

Information

Published : 2025-11-11 17:15

Updated : 2026-10-18 21:10

NVD link : CVE-2025-23361

Mitre link : CVE-2025-23361

CVE.ORG link : CVE-2025-23361

JSON object : View

Products Affected

nvidia

nemo

CWE

CWE-94

Improper Control of Generation of Code ('Code Injection')

{"id": "CVE-2025-23361", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-23361", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-11-12T04:58:02.636433Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@nvidia.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "affected": [{"source": "psirt@nvidia.com", "affectedData": [{"vendor": "NVIDIA", "product": "NeMo Framework", "versions": [{"status": "affected", "version": "All versions prior to 2.5.0"}], "platforms": ["All platforms"], "defaultStatus": "unaffected"}]}], "published": "2025-11-11T17:15:41.260", "references": [{"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23361", "tags": ["Technical Description"], "source": "psirt@nvidia.com"}, {"url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5718", "tags": ["Vendor Advisory"], "source": "psirt@nvidia.com"}, {"url": "https://www.cve.org/CVERecord?id=CVE-2025-23361", "tags": ["Technical Description"], "source": "psirt@nvidia.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@nvidia.com", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "NVIDIA NeMo Framework for all platforms contains a vulnerability in a script, where malicious input created by an attacker may cause improper control of code generation. A successful exploit of this vulnerability may lead to code execution, escalation of privileges, information disclosure, and data tampering."}, {"lang": "es", "value": "El NVIDIA NeMo Framework para todas las plataformas contiene una vulnerabilidad en un script, donde una entrada maliciosa creada por un atacante puede causar un control inadecuado de la generaci\u00f3n de c\u00f3digo. Un exploit exitoso de esta vulnerabilidad puede conducir a la ejecuci\u00f3n de c\u00f3digo, escalada de privilegios, revelaci\u00f3n de informaci\u00f3n y manipulaci\u00f3n de datos."}], "lastModified": "2026-10-18T21:10:00.120", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:nvidia:nemo:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E20B853E-AC64-49E9-9DB0-31981B034BFA", "versionEndExcluding": "2.5.0"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@nvidia.com"}