NVIDIA NemoClaw for Linux contains an OS command injection flaw in its NIM management component. An attacker who is able to supply arbitrary command strings can achieve full code execution, tamper with data, disclose sensitive information, and disrupt availability. The weakness is a classic command injection (CWE-78).

The affected product is NVIDIA NemoClaw for Linux. Specific affected release versions are not listed in the available data, so any current installations of NemoClaw that have not been confirmed patched should be considered vulnerable.

The CVSS score of 7.8 indicates a high severity, with potential for code execution and other impacts. EPSS is not available, so the exploitation probability cannot be quantified. The vulnerability is not listed in CISA’s KEV catalog, suggesting no confirmed widespread exploitation yet. The vulnerability is likely exploitable via the NIM management interface, which may be reachable either locally or over the network, making the attack vector potentially network‑based.