nemo-toolkit (1.2.0), ratsnlp (0.0.9993) +1 more potentially affected by CVE-2026-9856 via transformers (4.8.1)

transformers PYPI version 4.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - nemo-toolkit 1.2.0 - ratsnlp 0.0.9993 - summac =0.0.1, =0.0.3 Source cves: CVE-2026-9856 Source advisory: OSV:GHSA-XRQW-3RRV-VX5W...

nemo-toolkit (1.1.0) potentially affected by CVE-2026-58659 via pytorch-lightning (1.3.7.post0)

pytorch-lightning PYPI version 1.3.7.post0 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - nemo-toolkit 1.1.0 Source cves: CVE-2026-58659 Source advisory: OSV:PYSEC-2026-3967...

argos-trains (0.1.0), fastmri (>=0.1.0.post210716, <=0.1.1) +5 more potentially affected by CVE-2026-31221 via pytorch-lightning (1.0.8)

pytorch-lightning PYPI version 1.0.8 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - argos-trains 0.1.0 - fastmri =0.1.0.post210716, =0.5.1, =0.5.3 - quickvision 0.1.1rc1 - raylab 0.14.12 Source cves:...

nemo-toolkit (1.0.0rc1) potentially affected by CVE-2026-31221 via pytorch-lightning (1.1.5)

pytorch-lightning PYPI version 1.1.5 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - nemo-toolkit 1.0.0rc1 Source cves: CVE-2026-31221 Source advisory: OSV:PYSEC-2026-3043...

variantworks (>=0.1.0.dev201117, <=0.1.0.dev210511) potentially affected by CVE-2026-24157 via nemo-toolkit (0.10.1)

nemo-toolkit PYPI version 0.10.1 is affected by a known vulnerability. The following packages have a transitive dependency on nemo-toolkit and may be impacted: - variantworks =0.1.0.dev201117, =0.1.0.dev210511 Source cves: CVE-2026-24157 Source advisory: OSV:PYSEC-2026-2674...

nemo-curator (0.5.1), neural-sync (>=0.1.0, <=0.1.2) +2 more potentially affected by CVE-2026-24157 via nemo-toolkit (1.23.0)

nemo-toolkit PYPI version 1.23.0 is affected by a known vulnerability. The following packages have a transitive dependency on nemo-toolkit and may be impacted: - nemo-curator 0.5.1 - neural-sync =0.1.0, =0.1.0, =0.0.3, =0.0.4 Source cves: CVE-2026-24157 Source advisory: OSV:PYSEC-2026-2674...

entity-model (>=1.0.0, <=1.0.9), fast-whisper-diarizer (>=0.1.2, <=0.1.32) +21 more potentially affected by CVE-2026-24157 via nemo-toolkit (>=2.0.0rc0, <=2.6.1)

nemo-toolkit PYPI version =2.0.0rc0, =1.0.0, =0.1.2, =0.5.0, =5.1.6, =1.0.0, =0.0.1, =1.0.0, =1.0.0, =2.0.8, =1.0.0, =1.0.0, =1.0.7 and more Source cves: CVE-2026-24157 Source advisory: OSV:PYSEC-2026-2674...

ovos-tts-plugin-deepponies (>=0.0.1, <=0.0.2) potentially affected by CVE-2026-24157 via nemo-toolkit (1.5.1)

nemo-toolkit PYPI version 1.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on nemo-toolkit and may be impacted: - ovos-tts-plugin-deepponies =0.0.1, =0.0.2 Source cves: CVE-2026-24157 Source advisory: OSV:PYSEC-2026-2674...

fast-whisper-diarizer (>=0.1.2, <=0.1.32), faster-whisper-hotkey (>=0.5.0, <=0.5.5) +8 more potentially affected by CVE-2025-33245 via nemo-toolkit (>=2.0.0rc0, <=2.5.3)

nemo-toolkit PYPI version =2.0.0rc0, =0.1.2, =0.5.0, =1.0.0, =0.0.1, =1.0.3, =1.0.7 Source cves: CVE-2025-33245 Source advisory: OSV:PYSEC-2026-2672...

nemo-curator (0.5.1), neural-sync (>=0.1.0, <=0.1.2) +2 more potentially affected by CVE-2025-33245 via nemo-toolkit (1.23.0)

nemo-toolkit PYPI version 1.23.0 is affected by a known vulnerability. The following packages have a transitive dependency on nemo-toolkit and may be impacted: - nemo-curator 0.5.1 - neural-sync =0.1.0, =0.1.0, =0.0.3, =0.0.4 Source cves: CVE-2025-33245 Source advisory: OSV:PYSEC-2026-2672...

PYSEC-2026-685 Path Traversal in nemo-toolkit

NVIDIA NeMo before 1.6.0 contains a vulnerability in ASR WebApp, in which ../ Path Traversal may lead to deletion of any directory when admin privileges are available...

nemo-toolkit (1.2.0), ratsnlp (0.0.9993) +1 more potentially affected by CVE-2026-5241 via transformers (4.8.1)

transformers PYPI version 4.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - nemo-toolkit 1.2.0 - ratsnlp 0.0.9993 - summac =0.0.1, =0.0.3 Source cves: CVE-2026-5241 Source advisory: OSV:PYSEC-2026-2290...

nemo-toolkit (1.2.0), ratsnlp (0.0.9993) +1 more potentially affected by CVE-2026-4372 via transformers (4.8.1)

transformers PYPI version 4.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - nemo-toolkit 1.2.0 - ratsnlp 0.0.9993 - summac =0.0.1, =0.0.3 Source cves: CVE-2026-4372 Source advisory: OSV:GHSA-29PF-2H5F-8G72...

nemo-toolkit (1.2.0), ratsnlp (0.0.9993) +1 more potentially affected by CVE-2026-4372 via transformers (4.8.1)

transformers PYPI version 4.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - nemo-toolkit 1.2.0 - ratsnlp 0.0.9993 - summac =0.0.1, =0.0.3 Source cves: CVE-2026-4372 Source advisory: OSV:PYSEC-2026-2289...

nemo-toolkit (1.1.0) potentially affected by CVE-2026-31221 via pytorch-lightning (1.3.7.post0)

pytorch-lightning PYPI version 1.3.7.post0 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - nemo-toolkit 1.1.0 Source cves: CVE-2026-31221 Source advisory: OSV:GHSA-75M9-98V2-HJPM...

nemo-toolkit (1.0.0rc1) potentially affected by CVE-2026-31221 via pytorch-lightning (1.1.5)

pytorch-lightning PYPI version 1.1.5 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - nemo-toolkit 1.0.0rc1 Source cves: CVE-2026-31221 Source advisory: OSV:GHSA-75M9-98V2-HJPM...

argos-trains (0.1.0), fastmri (>=0.1.0.post210716, <=0.1.1) +5 more potentially affected by CVE-2026-31221 via pytorch-lightning (1.0.8)

pytorch-lightning PYPI version 1.0.8 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - argos-trains 0.1.0 - fastmri =0.1.0.post210716, =0.5.1, =0.5.3 - quickvision 0.1.1rc1 - raylab 0.14.12 Source cves:...

nemo-toolkit (1.2.0), ratsnlp (0.0.9993) +1 more potentially affected by CVE-2026-1839 via transformers (4.8.1)

transformers PYPI version 4.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - nemo-toolkit 1.2.0 - ratsnlp 0.0.9993 - summac =0.0.1, =0.0.3 Source cves: CVE-2026-1839 Source advisory: OSV:GHSA-69W3-R845-3855...

nemo-toolkit (1.2.0), ratsnlp (0.0.9993) +1 more potentially affected by CVE-2026-1839 via transformers (4.8.1)

transformers PYPI version 4.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - nemo-toolkit 1.2.0 - ratsnlp 0.0.9993 - summac =0.0.1, =0.0.3 Source cves: CVE-2026-1839 Source advisory: OSV:PYSEC-2026-2288...

Deserialization of Untrusted Data

Overview nemo-toolkit is a NeMo - a toolkit for Conversational AI Affected versions of this package are vulnerable to Deserialization of Untrusted Data the HFCheckpointIO checkpoint-loading process in nemo/lightning/io/hf.py. An attacker can execute arbitrary code on the victim system by supplyin...