NVIDIA Merlin Transformers4Rec: The Trainer component deserializes untrusted data, reaching code execution
Impact
The Trainer component deserializes untrusted data, reaching code execution. In an AI datacenter this is the model-and-data supply chain problem: the code runs with whatever the training or inference job holds, which is usually a GPU, a service account, and mounted object storage credentials.
Who can reach it
Requires the job to load an attacker-influenced artifact - a checkpoint, .nemo file, config, tokenizer or dataset. Any pipeline that pulls from a public model hub, a customer bucket, or a tenant-supplied path is in scope.
What to do
Bump the package to the fixed version in bulletin 5739 and rebuild every training/inference image that embeds it. Cost: image rebuild and job restart; no host driver or firmware change. The durable control is refusing to deserialize untrusted checkpoints at all - prefer safetensors-style formats and treat pickle-bearing artifacts as executable code.
References
Related entries
- NVIDIA Merlin Transformers4Rec: A Python dependency permits code injection into the recommender training jobCVE-2025-23298 · NVIDIA Merlin Transformers4RecHigh
- NVIDIA Merlin Transformers4Rec: Improper deserialization of untrusted data reaches code execution and informationCVE-2026-24162 · NVIDIA Merlin Transformers4RecHigh
- NVIDIA NVTabular: The Workflow component deserializes untrusted data, reaching code executionCVE-2025-33214 · NVIDIA NVTabularHigh
- BioNeMo Framework: Remote RCE via untrusted serializationCVE-2026-24164 · BioNeMo FrameworkHigh
- NVIDIA FLARE SDK: RCE via unsafe deserialization in message handlingCVE-2026-24186 · NVIDIA FLARE SDKHigh
- GPU Display Driver: Local privesc to host root (use-after-free in context handling)CVE-2026-24187 · GPU Display DriverHigh
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.