CVE-2026-65179 in NeMo
Summary
by MITRE • 09/22/2026
NVIDIA NeMo contains a vulnerability in the TabularTokenizer class where it deserializes an untrusted, attacker-controlled .pkl file via pickle.load() without validation. A successful exploit of this vulnerability may lead to code execution, data tampering, denial of service, and information disclosure.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/22/2026
The NVIDIA NeMo framework contains a critical security flaw within the TabularTokenizer class that stems from an insecure deserialization mechanism. This vulnerability arises because the component utilizes Python's pickle module to load serialized objects directly from untrusted sources without performing any prior validation or sanitization of the input data. Specifically, when processing .pkl files, the application invokes pickle.load() on content controlled by an external actor. In standard software engineering practices for machine learning pipelines, tokenizers are often used to process structured tabular data, and while these inputs might typically be expected to come from trusted datasets, the lack of strict input validation creates a significant attack surface if any part of the pipeline allows user-supplied or externally sourced pickle files to be processed.
The technical root cause is classified under CWE-502, which denotes Deserialization of Untrusted Data. The Python pickle module is inherently unsafe for deserializing data from untrusted sources because it can instantiate arbitrary classes and execute code during the unpickling process. When an attacker crafts a malicious .pkl file containing specially constructed objects with dangerous payloads in their _reduce_ or _setstate_ methods, the execution of pickle.load() triggers these methods immediately upon loading. This bypasses any application-level logic that might otherwise restrict operations to safe data types like integers or strings, effectively granting the attacker control over the interpreter's behavior during the deserialization phase.
The operational impact of exploiting this vulnerability is severe and multifaceted. The most critical consequence is remote code execution, allowing an adversary to run arbitrary commands on the host system with the privileges of the user running the NeMo process. Beyond immediate code execution, attackers can leverage this flaw for data tampering by modifying model weights or training datasets stored in memory before they are persisted. Additionally, a denial of service condition can be induced if the crafted payload causes excessive resource consumption or crashes the application during deserialization. Information disclosure is also possible as the attacker may access sensitive variables and configurations loaded into the object's state, potentially exposing API keys, database credentials, or proprietary model architectures stored within the serialized objects.
From a threat intelligence perspective, this vulnerability aligns with MITRE ATT&CK technique T1203, which covers Exploitation for Client Execution, specifically when targeting applications that handle user inputs. It also relates to T1059, Command and Scripting Interpreter, as the deserialization flaw serves as an initial access vector leading to arbitrary code execution. The attack path typically involves tricking a data scientist or automated pipeline into loading a malicious pickle file, which could be disguised as legitimate training data or configuration files in shared repositories or email attachments.
To mitigate this risk, immediate remediation is required by replacing the use of pickle.load() with safer serialization formats such as JSON, YAML, or Protocol Buffers that do not support arbitrary code execution during deserialization. If pickle must remain in use for legacy compatibility, developers should implement strict allow-listing mechanisms using the pickle.Unpickler subclass to restrict which classes can be instantiated. Furthermore, input validation routines should be added to verify file integrity and origin before any loading operations occur. NVIDIA has acknowledged this issue and released patches that address the insecure deserialization pattern within the TabularTokenizer class. Users are strongly advised to update their NeMo installations to the latest patched version and audit existing scripts for similar unsafe pickle usage patterns across other components of the framework.