CVE-2025-23360 is a high severity (CVSS 7.1) relative path traversal flaw in the NVIDIA NeMo Framework that allows an arbitrary file write, with possible code execution and data tampering. NVIDIA lists all versions prior to 24.12 on Windows, Linux and macOS as affected and 24.12 as the update.
What's affected
NVIDIA's bulletin of 11 March 2025 for NeMo Framework lists Windows, Linux and macOS, with all versions prior to 24.12 affected and 24.12 as the updated version. NVIDIA adds that earlier software branch releases are also affected. The bulletin credits Or Peles of JFrog Security.
The vector is AV:L/AC:L/PR:N/UI:R: local, low complexity, no privileges, and user interaction required. That fits an archive or file that a user is persuaded to open. The impact is rated high for integrity and availability, with no confidentiality impact.
How to check if you're exposed
NeMo is usually installed as a Python package or inside an NVIDIA container.
pip show nemo_toolkit
pip list | grep -i nemo
In containers, check the image tag, since NVIDIA NeMo containers use a release label. Anything older than 25.02 is affected. Also search shared model storage and pipelines for files that came from outside, such as model checkpoints, because the user interaction in the vector is likely to be loading or opening such content.
Reading an inventory is faster than checking host by host. Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan and a Gold directory you can search for any CVE. Reachability analysis helps you see whether a vulnerable component is actually used in your code, so you can fix the exposed ones first.
What to do now
- Upgrade NeMo Framework to 24.12 or later, and preferably to the current release since later bulletins exist.
- Rebuild containers that pin an older release.
- Do not unpack archives or load model packages from untrusted sources into directories that hold code or configuration.
- Run NeMo jobs as a low privilege user with write access limited to a working directory.
- Scan your Python environments for NeMo and its other advisories.
Why it matters
CWE-23 is relative path traversal. Input contains sequences that move up the directory tree, and the code uses them when writing a file, so the file lands outside the intended folder. If the location is a place where code or configuration is read, the write becomes a way to run code later.
NVIDIA's bulletin states the possible outcomes as code execution and data tampering and does not describe the mechanism. Note that this is the oldest of the NeMo bulletins in this series, and two later ones, in April and August 2025, fixed more issues. Staying on one old release means collecting all of them. The KEV flag is false.
Quick check
Which version fixes it?
NeMo Framework 24.12. Versions prior to 24.12 are affected.
Is 24.12 enough today?
It fixes this CVE, but NVIDIA published later NeMo bulletins that need 25.02 and 2.3.2, so move to a current release.
Sources
Last reviewed: 19 October 2026.
