CVE-2025-33249: nvidia nemo Command Injection

Vulnerability summary

CVE-2025-33249 is a high (CVSS 7.8) Command Injection vulnerability in nvidia nemo. EPSS estimates a 0.20% chance of exploitation in the next 30 days, higher than 9% of scored vulnerabilities.

Timeline

1. 18-02-2026
   PublishedVulnerability first disclosed.
2. 26-02-2026
   Last modifiedVulnerability information updated.

Description

NVIDIA NeMo Framework for all platforms contains a vulnerability in a voice-preprocessing script, where malicious input created by an attacker could cause a code injection. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure, and data tampering.

• CWE-77Improper Neutralization of Special Elements used in a Command ('Command Injection')The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.