CVE-2025-23304: 
NixOS vulnerability analysis and mitigation

CVE-2025-23304 is a code injection vulnerability in the NVIDIA NeMo library's model loading component, where an attacker can trigger arbitrary code execution by supplying .nemo files with maliciously crafted metadata. It affects all platforms (Windows, Linux, macOS) running NVIDIA NeMo versions prior to 2.3.2 (and prior to 24.12 for the legacy branch). The vulnerability was published on August 13, 2025. NIST NVD assigned a CVSS v3.1 base score of 9.8 (Critical), while NVIDIA's own CNA scoring is 7.8 (High) (NVD, NVIDIA Advisory).

The vulnerability is classified under CWE-22 (Path Traversal) and CWE-94 (Code Injection), indicating that the NeMo model loading component fails to properly restrict file path access and sanitize metadata embedded in .nemo archive files before processing it (NVD). A .nemo file is a compressed archive containing model weights and metadata; by crafting malicious metadata within this archive, an attacker can cause the library to execute injected code during the model loading process. No authentication or user interaction is required according to NIST's network-based CVSS assessment, though NVIDIA's own scoring reflects a local attack vector, suggesting the primary exploitation path may involve distributing poisoned model files through repositories such as Hugging Face (Unit 42, BankInfoSecurity).

Successful exploitation can result in remote code execution and data tampering on the host system running the vulnerable NeMo library, with full impact to confidentiality, integrity, and availability (NVD). An attacker who tricks a user or automated pipeline into loading a malicious .nemo model file gains code execution in the context of the NeMo process, potentially enabling credential theft, lateral movement within ML infrastructure, or poisoning of AI model outputs. The attack surface is particularly broad given the widespread use of NeMo in AI/ML workflows and the common practice of downloading pre-trained models from public repositories (Unit 42, ThreatsHub).

No public proof-of-concept exploit code has been observed, and there is no confirmed evidence of in-the-wild exploitation at this time (Feedly). The EPSS score is approximately 0.043%, reflecting a currently low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, Palo Alto Networks Unit 42 has highlighted this class of vulnerability — poisoned model metadata in AI Python libraries — as a realistic and emerging threat vector, particularly through model-sharing platforms like Hugging Face (Unit 42).

1. Reconnaissance: Identify targets using NVIDIA NeMo library versions prior to 2.3.2 or 24.12, particularly organizations running automated ML pipelines or downloading models from public repositories such as Hugging Face.
2. Craft malicious .nemo file: Create a .nemo archive (a compressed file containing model weights and metadata) with maliciously crafted metadata that exploits the path traversal (CWE-22) and code injection (CWE-94) weaknesses in the model loading component.
3. Distribute the poisoned model: Upload the malicious .nemo file to a public model repository, share it via social engineering, or inject it into a supply chain where the target organization automatically downloads and loads models.
4. Trigger model loading: Wait for or induce the target system to load the malicious .nemo file using the vulnerable NeMo library (e.g., via nemo.collections model restore functions).
5. Achieve code execution: The injected code within the crafted metadata executes in the context of the NeMo process, enabling arbitrary command execution, data exfiltration, or further lateral movement within the ML infrastructure (Unit 42, NVD).

• File System: Unexpected files written outside the intended model directory during .nemo file loading; presence of unfamiliar scripts or executables in directories accessible by the NeMo process; .nemo files with anomalous metadata structures or unusually large metadata sections.
• Process: Unexpected child processes spawned by the Python/NeMo process (e.g., bash, sh, curl, wget, python -c); unusual network connections initiated by the NeMo process immediately after model loading.
• Network: Outbound connections to unknown external IPs or domains from ML servers shortly after model loading events; DNS queries for unfamiliar domains from systems running NeMo.
• Logs: Python tracebacks or errors related to file path operations during model loading in application logs; unexpected file access patterns in OS audit logs (e.g., auditd) showing path traversal attempts (e.g., ../ sequences) during .nemo extraction.

NVIDIA has released patched versions of the NeMo library: users should upgrade to NeMo 2.3.2 or later (or 24.12 or later for the legacy branch) to remediate this vulnerability (NVIDIA Advisory). As interim mitigations, organizations should restrict loading of .nemo files to trusted, verified sources only; implement strict file access controls and sandboxing for model loading processes; and isolate NeMo-based systems from critical infrastructure until patching is complete. Monitoring for suspicious model loading activities and unauthorized file access attempts is also recommended.

Heise reported on the vulnerability as part of broader NVIDIA AI software security fixes in August 2025 (Heise). Palo Alto Networks Unit 42 published a threat intelligence report highlighting CVE-2025-23304 alongside similar RCE vulnerabilities in AI Python libraries, framing the poisoned model metadata attack as an emerging supply chain threat vector (Unit 42). Multiple security news outlets including BankInfoSecurity, DataBreachToday, and GovInfoSecurity covered the broader issue of AI library flaws enabling remote code execution, with community discussion noting the particular risk posed by model-sharing platforms like Hugging Face (BankInfoSecurity, ThreatsHub).