NVIDIA NeMo Framework: crafted data in the NLP component injects code into the running job (CWE-94)

CVSS 7.8CVE-2025-23313NVIDIA / GPU stack+1 more CVEscurated

Impact

Attacker-controlled data processed by the NeMo NLP component executes arbitrary code inside the training or inference job, which typically holds a GPU, a service account and mounted object-storage credentials; NVIDIA split this NLP-component code-injection issue across 2 ids (CVE-2025-23313, CVE-2025-23314) in bulletin 5689 without describing any difference between them.

Who can reach it

Requires the job to load an attacker-influenced artifact - a checkpoint, .nemo file, config, tokenizer or dataset. Any pipeline that pulls from a public model hub, a customer bucket, or a tenant-supplied path is in scope.

What to do

Upgrade NeMo Framework to 2.4.0 (GitHub or PyPI) and rebuild every training/inference image that embeds it - one bump clears both ids. Cost: image rebuild and job restart; no host driver or firmware change. The durable control is refusing to deserialize untrusted checkpoints at all: prefer safetensors-style formats and treat pickle-bearing artifacts as executable code.

Also covers 1 CVE

The vendor assigned a separate id to each affected code path. They share this advisory, this score and this fix, so they are one entry here.

CVE-2025-23314

References

https://nvd.nist.gov/vuln/detail/CVE-2025-23313 https://github.com/NVIDIA/product-security/tree/main/2025/5689

Related entries

All NVIDIA / GPU stack entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.