CVE-2026-24252 is an OS command injection vulnerability in the NVIDIA NeMo Framework for Linux. It arises from improper neutralization of special elements used in OS commands, enabling an attacker with local access and low privileges to execute arbitrary commands on the host system. The vulnerability impacts confidentiality, integrity, and availability, with a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). No vendor advisory or patch information is available at this time.

Exploitation of this vulnerability can result in arbitrary code execution, unauthorized data modification, escalation of privileges, and disclosure of sensitive information on affected systems running NVIDIA NeMo Framework on Linux. The attacker requires local access with low privileges but no user interaction is needed. This poses a significant risk to system security and data integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict local access to trusted users only and monitor for suspicious activity related to the NeMo Framework. Avoid running the framework with elevated privileges where possible.