# CVE-2026-24252: NVIDIA NeMo OS command injection on Linux

Source: https://junglewise.ai/threats/cve-2026-24252-nvidia-nemo-os-command-injection-on-linux  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-27. Updated: 2026-07-27  
License: CC BY 4.0 with a link back

CVE-2026-24252 · Severity: high · CVSS 7.8 · Published 2026-07-27

NVIDIA NeMo, a framework used by developers to build and deploy generative AI models, contains a security flaw on Linux systems. A local attacker with basic access to the system could exploit this vulnerability to run unauthorized commands. This could lead to the theft of sensitive AI training data, unauthorized system changes, or full control over the affected server.

Technologies: [Nvidia NeMo Framework](https://junglewise.ai/threats/technologies/nemo-framework). Vendors: [Nvidia](https://junglewise.ai/threats/vendors/nvidia).

## Quick answers

**Is CVE-2026-24252 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-24252 being exploited in the wild.

**How severe is CVE-2026-24252?** High severity, with a CVSS score of 7.8, published 27 July 2026.

**Which products and versions are affected?** Nvidia NeMo Framework 0.0 to 2.7.2.

**Is there a fix for CVE-2026-24252?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-24252 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-24252?** Check whether you run Nvidia NeMo Framework at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An OS command injection vulnerability (CWE-78) exists in NVIDIA NeMo Framework for Linux in versions 0.0 through 2.7.2. The flaw allows a local attacker with low privileges to inject and execute arbitrary shell commands on the host system without user interaction. Successful exploitation can result in full system compromise, including unauthorized code execution, privilege escalation, and sensitive information disclosure. Users are advised to review NVIDIA's security advisory for specific patching or mitigation instructions.

## Affected products

- NVIDIA NeMo Framework 0.0 to 2.7.2

## Timeline

- 2026-07-27: advisory: NVIDIA published the security advisory and CVE details.

## References

- [https://nvidia.custhelp.com/app/answers/detail/a_id/5839](https://nvidia.custhelp.com/app/answers/detail/a_id/5839)
- [https://www.cve.org/CVERecord?id=CVE-2026-24252](https://www.cve.org/CVERecord?id=CVE-2026-24252)

## Related threats

- [NVIDIA NeMo Framework deserialization of untrusted data on Linux](https://junglewise.ai/threats/cve-2026-24228-nvidia-nemo-framework-deserialization-of-untrusted-data-on-linux)
- [NVIDIA NeMo Framework code injection](https://junglewise.ai/threats/cve-2026-24155-nvidia-nemo-framework-code-injection)