entity-model (>=1.0.0, <=1.0.9), fast-whisper-diarizer (>=0.1.2, <=0.1.32) +21 more potentially affected by CVE-2026-24157 via nemo-toolkit (>=2.0.0rc0, <=2.6.1)

nemo-toolkit PYPI version =2.0.0rc0, =1.0.0, =0.1.2, =0.5.0, =5.1.6, =1.0.0, =0.0.1, =1.0.0, =1.0.0, =2.0.8, =1.0.0, =1.0.0, =1.0.7 and more Source cves: CVE-2026-24157 Source advisory: GHSA-M4JW-WGMF-889X...

variantworks (>=0.1.0.dev201117, <=0.1.0.dev210511) potentially affected by CVE-2026-24157 via nemo-toolkit (0.10.1)

nemo-toolkit PYPI version 0.10.1 is affected by a known vulnerability. The following packages have a transitive dependency on nemo-toolkit and may be impacted: - variantworks =0.1.0.dev201117, =0.1.0.dev210511 Source cves: CVE-2026-24157 Source advisory: OSV:GHSA-M4JW-WGMF-889X...

entity-model (>=1.0.0, <=1.0.9), fast-whisper-diarizer (>=0.1.2, <=0.1.32) +21 more potentially affected by CVE-2026-24157 via nemo-toolkit (>=2.0.0rc0, <=2.6.1)

nemo-toolkit PYPI version =2.0.0rc0, =1.0.0, =0.1.2, =0.5.0, =5.1.6, =1.0.0, =0.0.1, =1.0.0, =1.0.0, =2.0.8, =1.0.0, =1.0.0, =1.0.7 and more Source cves: CVE-2026-24157 Source advisory: OSV:GHSA-M4JW-WGMF-889X...

nemo-curator (0.5.1), neural-sync (>=0.1.0, <=0.1.2) +2 more potentially affected by CVE-2026-24157 via nemo-toolkit (1.23.0)

nemo-toolkit PYPI version 1.23.0 is affected by a known vulnerability. The following packages have a transitive dependency on nemo-toolkit and may be impacted: - nemo-curator 0.5.1 - neural-sync =0.1.0, =0.1.0, =0.0.3, =0.0.4 Source cves: CVE-2026-24157 Source advisory: OSV:GHSA-M4JW-WGMF-889X...

ovos-tts-plugin-deepponies (>=0.0.1, <=0.0.2) potentially affected by CVE-2026-24157 via nemo-toolkit (1.5.1)

nemo-toolkit PYPI version 1.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on nemo-toolkit and may be impacted: - ovos-tts-plugin-deepponies =0.0.1, =0.0.2 Source cves: CVE-2026-24157 Source advisory: OSV:GHSA-M4JW-WGMF-889X...

entity-model (>=1.0.0, <=1.0.9), fast-whisper-diarizer (>=0.1.2, <=0.1.32) +21 more potentially affected by CVE-2026-24157 via nemo-toolkit (>=2.0.0rc0, <=2.6.1)

nemo-toolkit PYPI version =2.0.0rc0, =1.0.0, =0.1.2, =0.5.0, =5.1.6, =1.0.0, =0.0.1, =1.0.0, =1.0.0, =2.0.8, =1.0.0, =1.0.0, =1.0.7 and more Source cves: CVE-2026-24157 Source advisory: SNYK:PYTHON-NEMOTOOLKIT-15912166...

Deserialization of Untrusted Data

Overview nemo-toolkit is a NeMo - a toolkit for Conversational AI Affected versions of this package are vulnerable to Deserialization of Untrusted Data through the torch.load checkpoint and model import paths in the nemo collections and checkpoint utilities. An attacker can execute arbitrary code...

entity-model (>=1.0.0, <=1.0.9), fast-whisper-diarizer (>=0.1.2, <=0.1.32) +27 more potentially affected by CVE-2026-24157 via nemo-toolkit (>=0.10.1, <=2.6.1)

nemo-toolkit PYPI version =0.10.1, =1.0.0, =0.1.2, =0.5.0, =5.1.6, =1.0.0, =0.0.1, =0.1.0, =0.1.0, =0.0.1, =1.0.0, =1.0.5 and more Source cves: CVE-2026-24157 Source advisory: MEND:CVE-2026-24157...

Deserialization of Untrusted Data

Overview nemo-toolkit is a NeMo - a toolkit for Conversational AI Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the deserialization process in the receivegenerateinfo function of audiotextgenerationutils.py. An attacker can execute arbitrary code, cause...

ovos-tts-plugin-deepponies (>=0.0.1, <=0.0.2) potentially affected by CVE-2025-33245 via nemo-toolkit (1.5.1)

nemo-toolkit PYPI version 1.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on nemo-toolkit and may be impacted: - ovos-tts-plugin-deepponies =0.0.1, =0.0.2 Source cves: CVE-2025-33245 Source advisory: OSV:GHSA-9379-MWVR-7WXX...

Deserialization of Untrusted Data

Overview nemo-toolkit is a NeMo - a toolkit for Conversational AI Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the model loading process with weightsonly=False. An attacker can execute arbitrary code, escalate privileges, disclose sensitive information...

fast-whisper-diarizer (>=0.1.2, <=0.1.32), faster-whisper-hotkey (>=0.5.0, <=0.5.5) +8 more potentially affected by CVE-2025-33245 via nemo-toolkit (>=2.0.0rc0, <=2.5.3)

nemo-toolkit PYPI version =2.0.0rc0, =0.1.2, =0.5.0, =1.0.0, =0.0.1, =1.0.3, =1.0.7 Source cves: CVE-2025-33245 Source advisory: SNYK:PYTHON-NEMOTOOLKIT-15325666...

fast-whisper-diarizer (>=0.1.2, <=0.1.32), faster-whisper-hotkey (>=0.5.0, <=0.5.5) +8 more potentially affected by CVE-2025-33245 via nemo-toolkit (>=2.0.0rc0, <=2.5.3)

nemo-toolkit PYPI version =2.0.0rc0, =0.1.2, =0.5.0, =1.0.0, =0.0.1, =1.0.3, =1.0.7 Source cves: CVE-2025-33245 Source advisory: OSV:GHSA-9379-MWVR-7WXX...

CVE-2025-33203

NVIDIA NeMo Agent Toolkit UI for Web contains a vulnerability in the chat API endpoint where an attacker may cause a Server-Side Request Forgery. A successful exploit of this vulnerability may lead to information disclosure and denial of service...

Deserialization of Untrusted Data

Overview nemo-toolkit is a NeMo - a toolkit for Conversational AI Affected versions of this package are vulnerable to Deserialization of Untrusted Data due to the deserialization of untrusted data. An attacker can execute arbitrary code and tamper with data by providing specially crafted input th...

Directory Traversal

Overview nemo-toolkit is a NeMo - a toolkit for Conversational AI Affected versions of this package are vulnerable to Directory Traversal via the model loading process. An attacker can execute arbitrary code and tamper with data by supplying a .nemo file containing maliciously crafted metadata...