Description

NVIDIA NeMo contains a vulnerability in the TabularTokenizer class where it deserializes an untrusted, attacker-controlled .pkl file via pickle.load() without validation. A successful exploit of this vulnerability may lead to code execution, data tampering, denial of service, and information disclosure.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-22T15:17:13.670Z",
  "pubdate": "2026-09-22T15:17:13.670Z",
  "executiveSummary": "This vulnerability involves an insecure deserialization flaw within the TabularTokenizer class of NVIDIA NeMo. The root cause is the usage of the pickle.load() function on untrusted, attacker-supplied .pkl files without implementing adequate validation or integrity checks.\nThe vulnerability allows an unauthenticated, remote attacker to achieve arbitrary code execution on the underlying host system. By crafting a malicious serialized object, an attacker can trigger the execution of arbitrary commands during the deserialization process.\nBeyond remote code execution, successful exploitation facilitates data tampering, denial of service (DoS) attacks, and unauthorized information disclosure. The risk implication is critical, as it bypasses standard application-level security controls by leveraging the inherent capability of Python's pickle module to execute arbitrary callables.\nThe exploitation requirement is minimal, necessitated only by the application's ingestion of a maliciously crafted .pkl file. Consequently, any deployment of NVIDIA NeMo that processes serialized tokenizer data from untrusted sources is considered highly vulnerable.",
  "technicalDetails": "The core of the vulnerability resides in the TabularTokenizer class, which utilizes the Python pickle library to restore state from file-based objects. The pickle module is inherently insecure when processing untrusted input because it does not just deserialize data; it interprets the byte stream as a series of instructions for the Python virtual machine.\nThe attack flow begins when an attacker provides a maliciously crafted .pkl file to the TabularTokenizer. When the class calls pickle.load(), the Python interpreter parses the binary stream, which can contain __reduce__ methods or similar constructs designed to instantiate arbitrary objects or call functions upon reconstruction.\nBy embedding a malicious payload into the pickle stream—specifically targeting the instantiation of os.system or similar sub-process spawning mechanisms—an attacker achieves immediate command execution with the privileges of the process running the NVIDIA NeMo environment. Because the deserialization occurs before any logic within the class can validate the contents, there is no opportunity for the application to reject the payload based on its internal structure or class definitions.\nThe exploitation method relies on the fundamental design of the pickle protocol, which allows for the serialization of complex Python objects. Attackers can leverage this to create a gadget chain that leads to remote code execution (RCE). Once the payload is triggered, the attacker's code executes within the context of the application's memory space. This provides significant post-exploitation capabilities, including but not limited to, exfiltrating sensitive model weights or training data, modifying system configurations, or pivoting to other segments of the internal network if the NeMo environment is integrated into a larger pipeline.\nThe vulnerability is persistent across implementations where TabularTokenizer is configured to load external, untrusted tokenizer configurations. As this involves direct memory manipulation via the Python object reconstruction lifecycle, it is highly effective and difficult to mitigate using traditional input filters or firewalls."
}