NVIDIA NeMo AI Curator Vulnerability Allows Code Execution and Privilege Escalation

NVIDIA released a security bulletin for NVIDIA® NeMo Curator addressing a high-severity vulnerability (CVE-2025-23307) that affects all prior versions of the Curator software. The flaw, rooted in improper handling of user-supplied files, allows a maliciously crafted file to be processed by NeMo Curator, leading to code injection and arbitrary code execution. Successful exploitation can result in unauthorized privilege escalation, disclosure of sensitive information, and data tampering.

This vulnerability is classified under CWE-94 (Improper Control of Generation of Code) and has been rated with a Base Score of 7.8 (High) using the CVSS v3.1 standard. According to NVIDIA, users operating NeMo Curator on Windows, Linux, or macOS should apply the security update contained in Curator 25.07 without delay, with earlier software branches also impacted and needing upgrade to the latest maintained release via the official NVIDIA GitHub repository or the NVIDIA Product Security page.