A vulnerability exists in a script used by NVIDIA Megatron-LM that allows an attacker to inject malicious data, leading to code injection. This flaw can be leveraged to execute arbitrary code, potentially escalating privileges, leaking sensitive information, and modifying data. The weakness is classified as CWE-94, which denotes code injection or statement injection.

The affected product is NVIDIA Megatron-LM, available for all platforms. No specific product versions or patches are listed in the available data, so any installation of Megatron-LM that includes the vulnerable script may be impacted.

The vulnerability has a CVSS score of 7.8, indicating a high overall risk. The EPSS score is reported as less than 1 %, suggesting that there is a very low probability of exploitation in the wild at present, and the issue is not listed in the CISA KEV catalog. The attack vector is inferred to involve the delivery of crafted input to the vulnerable script; depending on the script’s exposure, this may require local or remote access. Given the severity of potential impact, it is important to evaluate whether the environment exposes the script to untrusted data and to mitigate accordingly.