nemo-eval (0.2.0rc0) potentially affected by CVE-2026-24247 via megatron-bridge (0.2.0rc6)

megatron-bridge PYPI version 0.2.0rc6 is affected by a known vulnerability. The following packages have a transitive dependency on megatron-bridge and may be impacted: - nemo-eval 0.2.0rc0 Source cves: CVE-2026-24247 Source advisory: SNYK:PYTHON-MEGATRONBRIDGE-17756152...

CVE-2026-24247

creationtimestamp| type| source ---|---|--- 2026-07-01 16:01:51+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mplvbnh36e2i 2026-07-02 04:34:15+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpn7d2yb3a2o...

CVE-2026-24247

CVE-2026-24247 affects NVIDIA Megatron Bridge for Linux and is linked to deserialization of untrusted data, with potential for code execution, privilege escalation, data tampering, and information disclosure. The NVIDIA security bulletin notes mitigation by upgrading to version 0.4.1 or later (Me...