Description

NVIDIA NeMo contains a vulnerability in its dataset-loading workflow where a maliciously crafted model_config.yaml can inject unsafe parameters. A successful exploit of this vulnerability may lead to code execution, data tampering, denial of service, and information disclosure.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-09-22T15:17:13.550Z",
  "pubdate": "2026-09-22T15:17:13.550Z",
  "executiveSummary": "NVIDIA NeMo is susceptible to an arbitrary code execution vulnerability stemming from insecure handling of the model_config.yaml file within its dataset-loading workflow.\nThis vulnerability is classified as an input validation flaw, where the framework fails to sanitize parameters defined in configuration files before processing them.\nThe impact of a successful exploitation is critical, potentially allowing an unauthenticated attacker to achieve remote code execution, perform unauthorized data tampering, trigger a denial-of-service (DoS) condition, or facilitate sensitive information disclosure.\nBy supplying a maliciously crafted model_config.yaml, an adversary can manipulate the application's runtime behavior. The risk is significant for environments where users or external processes can influence the configuration files loaded by the NeMo framework.\nExploitation requires the attacker to have the ability to influence the contents of the configuration file ingested by the system during the model loading or training pipeline.\nOrganizations relying on NVIDIA NeMo should prioritize validating the integrity of their configuration inputs and restricting access to deployment directories.",
  "technicalDetails": "The vulnerability resides within the dataset-loading workflow of NVIDIA NeMo, specifically in how the framework parses and instantiates objects defined within model_config.yaml. The root cause is the insecure deserialization or improper handling of parameters that are treated as executable instructions or unsafe object references during runtime.\nWhen NVIDIA NeMo initializes a model or dataset, it reads the provided YAML configuration. If the framework uses vulnerable functions to deserialize this configuration, an attacker can inject malicious payloads into the YAML structure. By crafting a payload that leverages specific libraries or framework hooks, the attacker can force the application to execute arbitrary Python code or instantiate dangerous object types.\nThe attack flow proceeds as follows: First, the attacker identifies the path where NVIDIA NeMo monitors or expects model_config.yaml files. Second, the attacker creates a malformed YAML file containing the payload designed to trigger code execution upon parsing. Third, the attacker places this file into the target directory or influences a process that feeds this configuration into the NeMo framework. Finally, when the NeMo loader processes the malicious configuration, the underlying parser executes the injected parameters, leading to a compromise of the host system.\nThis vulnerability bypasses standard input validation layers because the framework implicitly trusts the configuration file as a legitimate definition of the model's architecture. Because the parsing often occurs with the privileges of the user running the training job or the inference server, the attacker inherits those execution permissions.\nThe post-exploitation impact is extensive; once arbitrary code execution is achieved, an attacker can pivot within the network, access local storage or mounted datasets to exfiltrate information, or corrupt data integrity by modifying underlying model parameters. Additionally, by invoking resource-intensive operations via the injected code, the attacker can easily crash the process or the entire host, resulting in a denial-of-service state. This vulnerability does not require prior authentication if the loading mechanism is exposed to an untrusted configuration source."
}