Ryan Tracey

**Name of the Vulnerable Software and Affected Versions** NVIDIA NeMo versions up to r2.0.0rc0 **Description** The issue is related to the SaveRestoreConnector function in NVIDIA NeMo, which is associated with incorrect restriction of the directory path name with limited access. Exploitation of this issue may allow an attacker to execute arbitrary code using specially crafted tar files. This can lead to code execution and data tampering. **Recommendations** For NVIDIA NeMo versions up to r2.0.0rc0, update to a patched version to resolve the issue. As a temporary workaround, consider restricting the use of the SaveRestoreConnector function to minimize the risk of exploitation. Avoid using unsafe .tar file extraction in the SaveRestoreConnector function until the issue is resolved.