Threats affecting pkg:npm/nemoclaw

NVIDIA NeMoClaw has a vulnerability in its sandbox environment initialization component that allows a remote attacker to cause improper access control. By sending prompt-injected content, the attacker can cause the agent to read and exfiltrate host environment variables that are not properly restricted during sandbox creation. This vulnerability can lead to the disclosure of sensitive system information. It affects all versions prior to v0.0.18. The vulnerability has a high severity with a CVSS score of 8.6. There is no confirmed patch or official remediation available at this time.