Zhuxs/nemo-safe-instantiate-bypass-poc

NeMo safe_instantiate() Allowlist Bypass — ACE via Crafted .nemo File

Vulnerability in NVIDIA NeMo 2.7.3

A crafted .nemo model file can bypass the safe_instantiate() security allowlist and achieve arbitrary code execution when loaded via restore_from().

Root Cause

from_config_dict() in nemo/core/classes/common.py has a legacy code path (Branch 3) that calls import_class_by_path() directly — bypassing the ALLOWED_TARGET_PREFIXES allowlist entirely.

Trigger condition: YAML config with target: key but NO params: and NO _target_:

Impact

Finding	Severity	Description
Allowlist bypass	CRITICAL	import_class_by_path imports ANY Python class (os.system, subprocess.Popen, etc.)
.py extraction	HIGH	_safe_extract() allows .py files in the archive
Raw tar.extract	HIGH	model_utils.load_config() uses unsanitized tar.extract()

Files

File	Description
poc_allowlist_bypass.nemo	Triggers Branch 3 with target: os.system
poc_rce_jupyter.nemo	Full RCE via embedded Python module (Jupyter context)
poc_pickle_chain.nemo	Pickle RCE chain via init_from_ptl_ckpt
generate_poc.py	PoC generator
poc_test.py	Automated verification (4/4 tests pass)

Reproduction

pip install nemo_toolkit==2.7.3
python poc_test.py

Verified Output

  6/6 dangerous targets bypass allowlist
  Branch 3 (VULNERABLE - direct import): True
  .py files pass _safe_extract: True
  model_utils.load_config() uses unsanitized tar.extract: True
  4/4 vulnerabilities confirmed

License

MIT