Database/AI/ML frameworks & serving
NVIDIA NemoClaw: OS command injection through the command-line interface
Impact
The NemoClaw CLI builds an OS command from input it does not adequately sanitise, so a crafted argument or value executes as a shell command with the privileges of whoever runs the CLI. NVIDIA lists code execution, data tampering, information disclosure and denial of service. The practical risk on a GPU node is anything that invokes the CLI on behalf of someone else - a deployment script, a CI job, or an operator running it against tenant-supplied names or paths - because the injected command then runs at the caller's privilege rather than the submitter's. The record does not say the CLI is directly reachable by untrusted users; treat the injection point as whatever supplies its arguments.
Who can reach it
A local, low-privileged actor who can influence the arguments or input passed to the NemoClaw CLI (CVSS AV:L, PR:L). Authentication required.
What to do
Update NemoClaw from the NVIDIA/NemoClaw GitHub repo; versions 0 through 0.0.25 are affected per bulletin 5872, with the fixed build listed per CVE in that bulletin's Security Updates table. Replacing the CLI binary is enough for new invocations - nothing needs a reboot - but any long-running service or automation that shells out to it should be restarted so it picks up the new version.
References
Related entries
- PyTorch (flatbuffer model parsing, torch::load / parse_and_initialize_mobile_module): MALICIOUS MODEL FILE TO MEMORYNCVD-2025-019-pytorch-flatbuffer-model-parsing · PyTorch (flatbuffer model parsing, torch::load / parse_and_initialize_mobile_module)High
- LangChain (Web Research Retriever): SSRFCVE-2024-3095 · LangChain (Web Research Retriever)High
- SitemapLoader: nested sitemap entries skip restrict_to_same_domain, giving readable SSRFCVE-2026-72848 · langchain-community SitemapLoader (nested sitemap index entries)High
- Headroom LLM proxy: client-chosen upstream base URL enables SSRF and leaks the Authorization headerCVE-2026-77775 · Headroom LLM proxy (x-headroom-base-url upstream selection)High
- JupyterLab: XSS via untrusted notebook contentCVE-2024-43805 · JupyterLabHigh
- ONNX: Directory traversal via `external_data` field in the tensor protoCVE-2022-25882 · ONNXHigh
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.