Command Injection Vulnerability in NVIDIA NeMo Framework ASR Evaluator Utility
CVE-2025-33246

7.8HIGH

Key Information:

Vendor

Nvidia
Status
Nemo Framework
Vendor
CVE Published:
18 February 2026

What is CVE-2025-33246?

The NVIDIA NeMo Framework includes a vulnerability within the ASR Evaluator utility that allows attackers to exploit command injection by providing malicious input through a configuration parameter. This may result in unauthorized code execution, potential elevation of privileges, data manipulation, or exposure of sensitive information, thereby compromising the security of affected systems.

Affected Version(s)

NeMo Framework All platforms All versions prior to 2.6.1

References

https://nvd.nist.gov/vuln/detail/CVE-2025-33246
https://www.cve.org/CVERecord?id=CVE-2025-33246
https://nvidia.custhelp.com/app/answers/detail/a_id/5762

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.