nemo-rce-poc

NVIDIA NeMo — Unsafe Deserialization PoC

Summary

NVIDIA NeMo framework contains 41+ instances of torch.load() without weights_only=True and 1 instance of raw pickle.load(), enabling arbitrary code execution when loading malicious model checkpoints.

Files

• malicious_nemo_model.ckpt — Malicious NeMo checkpoint (triggers via torch.load())
• malicious_tabular_tokenizer.pkl — Malicious pickle file (triggers via pickle.load())

Reproduction

import torch
# This triggers RCE — as NeMo does in 41+ locations
state = torch.load("malicious_nemo_model.ckpt")

import pickle
# This triggers RCE — as NeMo does in tabular_tokenizer.py:44
with open("malicious_tabular_tokenizer.pkl", "rb") as f:
    pickle.load(f)

Impact

Loading a malicious .nemo or .ckpt checkpoint achieves full Remote Code Execution. This affects the entire NeMo framework including TTS, ASR, NLP, and multimodal models.

Affected Version

NeMo v2.2.0+ (commit 530c684e5ceea7a3a73b5e0276e457ef1df489d0)