CVE-2025-23357CWE-94code-injection

CVE-2025-23357

High · published November 11, 2025

CVSS v3.1
7.8
EPSS
0%
Percentile
39.1
In the wild
Unconfirmed
What it is

⚡ A crafty script in NVIDIA Megatron-LM is leaving the door wide open for code injection! 🚪💥 Think of it as a restaurant where the chef takes orders without verifying what's written down — if a malicious diner slips in some sneaky instructions, the kitchen might just whip up something dangerous instead of your favorite dish! An attacker could leverage this vulnerability to execute arbitrary code, elevate their privileges, or even tamper with sensitive data. This could lead to disastrous information leaks or system disruptions, making it a significant threat to your operations.

Put simply

Think of it as a restaurant where the chef takes orders without verifying what's written down — if a malicious diner slips in some sneaky instructions, the kitchen might just whip up something dangerous instead of your favorite dish! This vulnerability allows for a code injection through a compromised script in NVIDIA Megatron-LM, enabling attackers to execute unauthorized commands on the system.

What to do

An attacker could leverage this vulnerability to execute arbitrary code, elevate their privileges, or even tamper with sensitive data. This could lead to disastrous information leaks or system disruptions, making it a significant threat to your operations. To mitigate this risk, immediately update to the latest version of NVIDIA Megatron-LM. Review and sanitize all input data to prevent code injection and consider implementing additional security measures, such as strict input validation protocols. You've got this! With these fixes implemented, your system will be safer in no time. 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00462 · 39.1th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2025-11-11T22:15Z
References (3)
EPSS history
Timeline
  • 11 NOV 16:17Z
    NVIDIA Megatron-LM for all platforms contains a vulnerability in a script, where malicious data created by an attacker may cause a code injection issue
    cvelistv5