CVE-2025-23361

NVIDIA NeMo Framework for all platforms contains a vulnerability in a script, where malicious input created by an attacker may cause improper control of code generation. A successful exploit of this vulnerability may lead to code execution, escalation of privileges, information disclosure, and da...

CVE-2025-23361

CVE-2025-23361 affects NVIDIA NeMo Framework. A vulnerability in a script allows malicious input to control code generation, with potential code execution, privilege escalation, information disclosure, and data tampering. Affected product: NVIDIA NeMo Framework (version context shows 2.0.3 in one...

CVE-2025-23361

NVIDIA NeMo Framework for all platforms contains a vulnerability in a script, where malicious input created by an attacker may cause improper control of code generation. A successful exploit of this vulnerability may lead to code execution, escalation of privileges, information disclosure, and da...

CVE-2025-23357

CVE-2025-23357 affects NVIDIA Megatron-LM across all platforms. The vulnerability resides in a vulnerable script that can process malicious data, enabling a code injection that may lead to code execution, privilege escalation, information disclosure, and data tampering. Documented sources indicat...

CVE-2025-23357

NVIDIA Megatron-LM for all platforms contains a vulnerability in a script, where malicious data created by an attacker may cause a code injection issue. A successful exploit of this vulnerability may lead to code execution, escalation of privileges, information disclosure, data tampering...

CVE-2025-23357

NVIDIA Megatron-LM for all platforms contains a vulnerability in a script, where malicious data created by an attacker may cause a code injection issue. A successful exploit of this vulnerability may lead to code execution, escalation of privileges, information disclosure, data tampering...

MAL-2025-118518 Malicious code in zul-rangginang80-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 297ac0a4099ee97d9fd0f150b192a1cffad7e52db3d7427fc01bdfb85879a757 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-113492 Malicious code in drunk_python_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector df4761ab8d6c68c11764980faf6d162db1f2beffe0f1349db9d764a0ed12e4e6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in rival_skink_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 43b0c7c98f6f76c54d63268783986523acc068213a85522a81a75af804c54f66 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in hurt_wallaby-appteadev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 59b95cb2436256624efe377a48b49b19eaa9684a06bece6045bf44693b0842c8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in continental_hamster_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e79768ce6061fdcb58e3e26174f833c015abfbd3428c68d1d59d621ea9acb22 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-87111 Malicious code in joko-martabak59-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 77dc3cc512e83817db5b674697cb6d4471aa482db96ff58e5bb74597b342641b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in irma-ragi62-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 965d50ea32c0497ff1621e377eb441b094adaa4cf1b7bc5846c334817c1949d0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in maman-mendut40-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f268acabb60727701eb9e85930bf32f35a90317681f59a2872e2034a7c005f5c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-74787 Malicious code in okta-kripik86-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 81d5630c980298d4bd45199f79f0ceadb2ab6288e6175124e6eabebaa1ae3fcb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in fitri-nasicampur22-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 215b732c26c05d06bf66b62396a75a4b8eba283f96b535186ad13a6a099c77fe This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in inadequate-emerald-porpoise (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e815434667fcf5dfd5df390db2707614adbadd56f7a71f9b0da6a63f1cab57f9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in eligible-amethyst-unicorn (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c1fe6c761c83ceda4baba3365f9d43e8d701ac2d4d0537e76aacba762a8641a7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-63087 Malicious code in galih-tahu29-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6c3072e9a7d551cf505b34995250b1357b948b60e09bf162d6075645378e396a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

PT-2025-46374

Name of the Vulnerable Software and Affected Versions NVIDIA NeMo Framework affected versions not specified Description The NVIDIA NeMo Framework contains a flaw within the bert services component. An attacker could craft malicious data that leads to code injection. Exploitation of this issue may...