CVE-2022-22821

Severity: medium (CVSS 4.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-01-10 · updated 2026-06-17
Weakness: CWE-22

Description

NVIDIA NeMo before 1.6.0 contains a vulnerability in ASR WebApp, in which ../ Path Traversal may lead to deletion of any directory when admin privileges are available.

Affected products

NVIDIA NeMo Framework: before 1.6.0 — fixed in 1.6.0

How to fix

Upgrade to a fixed version: NVIDIA NeMo Framework 1.6.0. Check the vendor advisory for mitigations.

References

https://github.com/NVIDIA/NeMo/security/advisories/GHSA-rpx7-33j2-xx9x
https://github.com/NVIDIA/NeMo/security/advisories/GHSA-rpx7-33j2-xx9x

Get alerted when CVE-2022-22821 or the next vulnerability affects your stack