Database/AI/ML frameworks & serving
NVIDIA NemoClaw: OS command injection in the NIM management component
Impact
NemoClaw's NIM management component passes attacker-influenced input into an OS command, giving code execution, data tampering, information disclosure and denial of service. This is the component that starts, stops and configures NIM inference microservices, so it typically runs with enough privilege to manage containers and GPU devices on the node - command execution there inherits that reach. An attacker who lands it can tamper with which model artifacts get served, read whatever credentials the management layer holds for pulling images, or shut the serving stack down. NVIDIA rates it 7.8 with high impact across confidentiality, integrity and availability.
Who can reach it
A local, low-privileged actor able to feed input to the NIM management component (CVSS AV:L, PR:L). Authentication is required; no user interaction.
What to do
Update NemoClaw from the NVIDIA/NemoClaw GitHub repo. Bulletin 5872 lists versions 0 through 0.0.25 as affected with fixed builds varying per CVE - take the exact version from the bulletin's Security Updates table rather than assuming the latest tag covers this one. Rolling the update means restarting the NemoClaw services and the NIMs they manage, so the node's inference capacity drops for the restart window.
References
Related entries
- NVIDIA NemoClaw: OS command injection in the Telegram bridge componentCVE-2026-65096 · NVIDIA NemoClaw for Linux (Telegram bridge component)High
- NVIDIA NemoClaw: OS command injection through the command-line interfaceCVE-2026-65099 · NVIDIA NemoClaw for Linux (command-line interface)High
- PyTorch (flatbuffer model parsing, torch::load / parse_and_initialize_mobile_module): MALICIOUS MODEL FILE TO MEMORYNCVD-2025-019-pytorch-flatbuffer-model-parsing · PyTorch (flatbuffer model parsing, torch::load / parse_and_initialize_mobile_module)High
- LangChain (Web Research Retriever): SSRFCVE-2024-3095 · LangChain (Web Research Retriever)High
- SitemapLoader: nested sitemap entries skip restrict_to_same_domain, giving readable SSRFCVE-2026-72848 · langchain-community SitemapLoader (nested sitemap index entries)High
- Headroom LLM proxy: client-chosen upstream base URL enables SSRF and leaks the Authorization headerCVE-2026-77775 · Headroom LLM proxy (x-headroom-base-url upstream selection)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.