CVE-2025-33204: 
NixOS vulnerability analysis and mitigation

CVE-2025-33204 is a code injection vulnerability in NVIDIA NeMo Framework affecting the NLP and LLM components across all platforms. Malicious data crafted by an attacker can trigger code injection, potentially leading to arbitrary code execution, privilege escalation, information disclosure, and data tampering. All NeMo Framework versions prior to 2.5.1 are affected. The vulnerability was published on November 25, 2025, with an initial analysis completed by NIST on December 2, 2025. It carries a CVSS v3.1 base score of 7.8 (High), assigned by NVIDIA Corporation (NVIDIA Advisory, Red Hat CVE).

The vulnerability is classified as CWE-94 (Improper Control of Generation of Code / Code Injection), meaning the NeMo Framework's NLP and LLM components fail to properly sanitize or validate attacker-supplied data before using it in a code generation or evaluation context. The attack vector is local (AV:L), requiring low privileges (PR:L) and no user interaction, with low attack complexity. An attacker with local access can supply malicious input data to the NLP or LLM processing pipeline, causing the framework to execute injected code within its runtime environment. No specific technical write-ups or public PoC code have been identified at this time (NVIDIA Advisory, Red Hat CVE).

Successful exploitation of CVE-2025-33204 can result in full compromise of confidentiality, integrity, and availability on the affected system. An attacker can execute arbitrary code within the NeMo Framework environment, escalate privileges beyond their initial low-privilege access, disclose sensitive information processed by NLP/LLM workloads (such as training data or model outputs), and tamper with system data. Given that NeMo is commonly deployed in AI/ML research and production environments, exploitation could expose proprietary model weights, sensitive datasets, or enable lateral movement within AI infrastructure (NVIDIA Advisory, Red Hat CVE).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation reported as of the time of publication (Red Hat CVE). The EPSS score is approximately 0.018%, indicating a very low current probability of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. A patch is available, and exploitation requires local access with low privileges, which somewhat limits the attack surface compared to network-exploitable vulnerabilities.

NVIDIA has released NeMo Framework version 2.5.1 to address this vulnerability; all users should upgrade immediately (NVIDIA Advisory). As interim mitigations, organizations should implement strict input validation for all data passed to NLP and LLM components, restrict local user access to NeMo Framework deployments following the principle of least privilege, and monitor for unusual code execution or data injection activity. A thorough security review of existing NeMo Framework deployments is also recommended.

Heise reported on the vulnerability as part of broader coverage of security flaws threatening NVIDIA AI hardware and software, including NeMo Framework (Heise). The vulnerability was noted in the CISA weekly vulnerability bulletin for the week of November 24, 2025 (CISA Bulletin). Community discussion on Mastodon (infosec.exchange) acknowledged the disclosure, and threat intelligence aggregators such as Hawk-Eye included it in their weekly threat landscape digest. Overall community reaction has been measured, reflecting the absence of active exploitation or public PoC.