CVE-2025-23361

{
  "id": "CVE-2025-23361",
  "sourceIdentifier": "[email protected]",
  "published": "2025-11-11T17:15:41.260",
  "lastModified": "2026-10-18T21:10:00.120",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "NVIDIA NeMo Framework for all platforms contains a vulnerability in a script, where malicious input created by an attacker may cause improper control of code generation. A successful exploit of this vulnerability may lead to code execution, escalation of privileges, information disclosure, and data tampering."
    },
    {
      "lang": "es",
      "value": "El NVIDIA NeMo Framework para todas las plataformas contiene una vulnerabilidad en un script, donde una entrada maliciosa creada por un atacante puede causar un control inadecuado de la generación de código. Un exploit exitoso de esta vulnerabilidad puede conducir a la ejecución de código, escalada de privilegios, revelación de información y manipulación de datos."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "NVIDIA",
          "product": "NeMo Framework",
          "defaultStatus": "unaffected",
          "platforms": [
            "All platforms"
          ],
          "versions": [
            {
              "version": "All versions prior to 2.5.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-11-12T04:58:02.636433Z",
          "id": "CVE-2025-23361",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:nvidia:nemo:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "2.5.0",
              "matchCriteriaId": "E20B853E-AC64-49E9-9DB0-31981B034BFA"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23361",
      "source": "[email protected]",
      "tags": [
        "Technical Description"
      ]
    },
    {
      "url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5718",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-23361",
      "source": "[email protected]",
      "tags": [
        "Technical Description"
      ]
    }
  ]
}