Description
NVIDIA NemoClaw for Linux contains a vulnerability in its NIM management component, where an attacker could cause OS command injection. A successful exploit of this vulnerability might lead to code execution, data tampering, information disclosure, and denial of service.
Published: 2026-08-25
Score: 7.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Apply Patch
AI Analysis

Impact

NVIDIA NemoClaw for Linux contains an OS command injection flaw in its NIM management component. An attacker who is able to supply arbitrary command strings can achieve full code execution, tamper with data, disclose sensitive information, and disrupt availability. The weakness is a classic command injection (CWE-78).

Affected Systems

The affected product is NVIDIA NemoClaw for Linux. Specific affected release versions are not listed in the available data, so any current installations of NemoClaw that have not been confirmed patched should be considered vulnerable.

Risk and Exploitability

The CVSS score of 7.8 indicates a high severity, with potential for code execution and other impacts. EPSS is not available, so the exploitation probability cannot be quantified. The vulnerability is not listed in CISA’s KEV catalog, suggesting no confirmed widespread exploitation yet. The vulnerability is likely exploitable via the NIM management interface, which may be reachable either locally or over the network, making the attack vector potentially network‑based.

Generated by OpenCVE AI on August 25, 2026 at 22:00 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply any official NVIDIA patch or upgrade to a non‑vulnerable release as soon as it is available.
  • If a patch cannot be applied immediately, restrict network access to the NIM management interface using firewall rules or network segmentation to limit exposure.
  • If the NIM component is not essential for operations, disable or uninstall it to remove the attack surface.

Generated by OpenCVE AI on August 25, 2026 at 22:00 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 01 Sep 2026 22:00:00 +0000

Type Values Removed Values Added
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:a:nvidia:nemoclaw:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel

Wed, 26 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 25 Aug 2026 22:30:00 +0000

Type Values Removed Values Added
Title OS Command Injection in NVIDIA NemoClaw NIM Management Leads to Remote Code Execution

Tue, 25 Aug 2026 21:45:00 +0000

Type Values Removed Values Added
First Time appeared Nvidia
Nvidia nemoclaw
Vendors & Products Nvidia
Nvidia nemoclaw

Tue, 25 Aug 2026 20:30:00 +0000

Type Values Removed Values Added
Description NVIDIA NemoClaw for Linux contains a vulnerability in its NIM management component, where an attacker could cause OS command injection. A successful exploit of this vulnerability might lead to code execution, data tampering, information disclosure, and denial of service.
Weaknesses CWE-78
References
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Linux Linux Kernel
Nvidia Nemoclaw
cve-icon MITRE

Status: PUBLISHED

Assigner: nvidia

Published:

Updated: 2026-08-26T14:40:00.612Z

Reserved: 2026-07-21T17:05:44.173Z

Link: CVE-2026-65090

cve-icon Vulnrichment

Updated: 2026-08-26T14:39:57.391Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-25T21:17:28.927

Modified: 2026-09-01T16:32:38.190

Link: CVE-2026-65090

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-25T22:15:04Z

Weaknesses
  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')