CVE-2025-23251 is a high severity (CVSS 7.6) improper control of code generation flaw in the NVIDIA NeMo Framework. It can lead to code execution and data tampering. NVIDIA lists all versions prior to 25.02 on Windows, Linux and macOS as affected, with 25.02 as the updated version.
What's affected
NVIDIA's April 2025 security bulletin for the NeMo Framework lists Windows, Linux and macOS, with all versions prior to 25.02 affected and 25.02 as the updated version. It was released on 22 April 2025. NVIDIA adds that earlier software branch releases are also affected, and that users on an earlier branch should upgrade to the latest release.
The bulletin covers three CVEs: CVE-2025-23249 (deserialization of untrusted data), CVE-2025-23250 (path traversal leading to arbitrary file write) and CVE-2025-23251 (improper control of code generation). Each scores 7.6 and each has user interaction required in its vector. NVIDIA credits Peng Zhou of Shanghai University for the reports.
How to check if you're exposed
NeMo is usually installed as a Python package or inside an NVIDIA container.
pip show nemo_toolkit
pip list | grep -i nemo
In containers, check the image tag, since NVIDIA NeMo containers use a release label. Anything older than 25.02 is affected. Also search shared model storage and pipelines for files that came from outside, such as model checkpoints, because the user interaction in the vector is likely to be loading or opening such content.
Reading an inventory is faster than checking host by host. Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan and a Gold directory you can search for any CVE. Reachability analysis helps you see whether a vulnerable component is actually used in your code, so you can fix the exposed ones first.
What to do now
- Upgrade NeMo Framework to 25.02 or later.
- Rebuild container images that pin an older NeMo release.
- Only load checkpoints, configs and archives from sources you trust.
- Run training and evaluation jobs with the minimum file system and network access they need.
- Add your Python environments to a dependency scan so NeMo advisories reach you.
Why it matters
CWE-94 is improper control of generation of code, or code injection. Software that builds or evaluates code from input it does not fully control can end up running what an attacker supplied. NVIDIA describes the impact as code execution and data tampering and gives no further mechanism.
In ML frameworks, configuration files often name classes or functions to load, which makes them a natural spot for this weakness. Configs and model packages that you did not write deserve the same care as scripts. The record's KEV flag is false and no exploitation is claimed.
Quick check
Which versions are safe?
NVIDIA lists 25.02 as the updated version. Anything prior to 25.02 is affected.
Do the three April NeMo CVEs share a fix?
Yes, they share the 25.02 update in the NVIDIA bulletin.
Sources
Last reviewed: 19 October 2026.
