CVE-2025-23250 is a high severity (CVSS 7.6) path traversal flaw in the NVIDIA NeMo Framework that allows an arbitrary file write, with possible code execution and data tampering. NVIDIA lists all versions prior to 25.02 on Windows, Linux and macOS as affected. Upgrade to 25.02 or later.
What's affected
NVIDIA's April 2025 security bulletin for the NeMo Framework lists Windows, Linux and macOS, with all versions prior to 25.02 affected and 25.02 as the updated version. It was released on 22 April 2025. NVIDIA adds that earlier software branch releases are also affected, and that users on an earlier branch should upgrade to the latest release.
The bulletin covers three CVEs: CVE-2025-23249 (deserialization of untrusted data), CVE-2025-23250 (path traversal leading to arbitrary file write) and CVE-2025-23251 (improper control of code generation). Each scores 7.6 and each has user interaction required in its vector. NVIDIA credits Peng Zhou of Shanghai University for the reports.
How to check if you're exposed
NeMo is usually installed as a Python package or inside an NVIDIA container.
pip show nemo_toolkit
pip list | grep -i nemo
In containers, check the image tag, since NVIDIA NeMo containers use a release label. Anything older than 25.02 is affected. Also search shared model storage and pipelines for files that came from outside, such as model checkpoints, because the user interaction in the vector is likely to be loading or opening such content.
Reading an inventory is faster than checking host by host. Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan and a Gold directory you can search for any CVE. Reachability analysis helps you see whether a vulnerable component is actually used in your code, so you can fix the exposed ones first.
What to do now
- Upgrade NeMo Framework to 25.02 or later.
- Rebuild container images that pin an older NeMo release.
- Only load checkpoints, configs and archives from sources you trust.
- Run training and evaluation jobs with the minimum file system and network access they need.
- Add your Python environments to a dependency scan so NeMo advisories reach you.
Why it matters
CWE-22 is improper limitation of a pathname to a restricted directory, known as path traversal. Code that builds a file path from outside input can be tricked into writing outside the folder it meant to use, for example while unpacking an archive. A file written in the wrong place, such as a script or a configuration file, can lead to code execution later.
NVIDIA's bulletin describes the result as possible code execution and data tampering. The standard defense is to resolve the final path and check that it stays inside the target directory before writing. Extract archives from trusted sources only. The KEV flag is false.
Quick check
Is 25.02 the fix for this one too?
Yes. NVIDIA's April 2025 bulletin lists 25.02 as the update for all three NeMo CVEs it covers.
What is the weakness class?
Path traversal, which lets a write land outside the intended directory.
Sources
Last reviewed: 19 October 2026.
