OS command injection vulnerability in NVIDIA NeMo Framework for Linux allows an attacker to execute arbitrary system commands through unvalidated input. The flaw enables code execution, privilege escalation, data tampering and information disclosure, which together constitute a high‑risk security breach.

All NVIDIA NeMo Framework releases for Linux are potentially affected, as vendor documentation does not provide distinguished versions. Until an official fix is released, any deployed instance may be compromised.

The CVSS score of 7.8 reflects a severe risk, while an EPSS score of < 1% indicates a low exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is through NeMo’s exposed interfaces that forward external data to the operating system shell, such as REST API endpoints, configuration parsers or command line utilities. A successfully delivered payload would run with the privileges of the NeMo process and could lead to full system compromise.