GHSA-hvjw-vp7g-39h5

Source

https://github.com/advisories/GHSA-hvjw-vp7g-39h5

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-hvjw-vp7g-39h5/GHSA-hvjw-vp7g-39h5.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-hvjw-vp7g-39h5

Aliases

Published

2026-02-18T15:31:26Z

Modified

2026-07-13T16:42:30Z

Severity

7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

NVIDIA NeMo Framework Deserializes Untrusted Data

Details

NVIDIA NeMo Framework contains a vulnerability where an attacker could cause remote code execution by convincing a user to load a maliciously crafted file. A successful exploit of this vulnerability might lead to code execution, denial of service, information disclosure, and data tampering.

Database specific

{
    "cwe_ids":  [
        "CWE-502"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-02-20T22:37:17Z",
    "nvd_published_at":  "2026-02-18T14:16:04Z",
    "severity":  "HIGH"
}

References

Affected packages

PyPI / nemo-toolkit

Package

Name: nemo-toolkit; View open source insights on deps.dev
Purl: pkg:pypi/nemo-toolkit

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.6.1

Affected versions

0.*

0.8

0.8.1

0.8.2

0.9.0

0.10.0b0

0.10.0b1

0.10.0b2

0.10.0b3

0.10.0b4

0.10.0b5

0.10.0b6

0.10.0b7

0.10.0b8

0.10.0b9

0.10.0b10

0.10.0

0.10.1

0.11.0b1

0.11.0b2

0.11.0b3

0.11.0b4

0.11.0b5

0.11.0b6

0.11.0b8

0.11.0b10

0.11.0b11

0.11.0b12

0.11.0b14

0.11.0

1.*

1.0.0a4

1.0.0b0

1.0.0b1

1.0.0b2

1.0.0b3

1.0.0rc1

1.0.0

1.0.1

1.0.2

1.1.0

1.2.0

1.3.0

1.4.0

1.5.0

1.5.1

1.6.0

1.6.1

1.6.2

1.7.0

1.7.1

1.7.2

1.8.0

1.8.1

1.8.2

1.9.0

1.10.0

1.11.0

1.12.0

1.13.0

1.14.0

1.15.0

1.16.0

1.17.0

1.18.0

1.18.1

1.19.0

1.19.1

1.20.0

1.21.0

1.22.0

1.23.0

2.*

2.0.0rc0

2.0.0rc1

2.0.0

2.1.0rc0

2.1.0rc1

2.1.0rc2

2.1.0

2.2.0rc0

2.2.0rc1

2.2.0rc2

2.2.0rc3

2.2.0

2.2.1

2.3.0rc2

2.3.0rc3

2.3.0rc4

2.3.0

2.3.1

2.3.2

2.3.3

2.4.0rc0

2.4.0rc1

2.4.0rc2

2.4.0

2.4.1

2.5.0rc0

2.5.0

2.5.1

2.5.2

2.5.3

2.6.0rc0

2.6.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-hvjw-vp7g-39h5/GHSA-hvjw-vp7g-39h5.json"