NVIDIA Warns of a High-Severity Flaw in NeMo AI Curator (CVE-2025-23307)

NVIDIA has released an important security update for its NeMo Curator tool after disclosing a high-severity vulnerability, tracked as CVE-2025-23307. According to the security bulletin, a malicious file created by an attacker could allow code injection, potentially leading to code execution, privilege escalation, information disclosure, and data tampering. The flaw carries a CVSS base score of 7.8 (High) with significant impact to confidentiality, integrity and availability.

If exploited, attackers could weaponise a specially crafted file to inject malicious code directly into NeMo Curator environments, enabling remote code execution and sensitive information disclosure, among other effects. The bulletin confirms that the vulnerability affects all versions of NVIDIA NeMo Curator on Windows, Linux and macOS prior to version 25.07, for which Curator 25.07 has been released as the patched version.