CVE-2022-22821 Path Traversal in nemo-toolkit
An attacker with admin privileges can delete any directory via path traversal in the NVIDIA NeMo ASR WebApp.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2022-22821?
CVE-2022-22821 is a low-severity path traversal vulnerability in n/a, published on 8 Jan 2022. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
NVIDIA NeMo before 1.6.0 contains a vulnerability in ASR WebApp, in which ../ Path Traversal may lead to deletion of any directory when admin privileges are available.
Weakness: CWE-22
Which versions are affected by CVE-2022-22821?
5 open source packages ship an affected version, including nemo-toolkit and nemo_toolkit. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
nemo-toolkit PyPI | All versions | 1.6.0 |
nemo-toolkit PyPI | All versions | 1.6.0 |
nemo-toolkit PyPI | All versions | 1.6.0 |
nemo-toolkit PyPI | All versions | 1.6.0 |
nemo_toolkit PyPI | All versions | 1.6.0 |
Products include Nvidia Nemo.
How do I fix CVE-2022-22821?
Upgrade nemo-toolkit to 1.6.0 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2022-22821 being exploited?
There is no known exploitation of CVE-2022-22821 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2024-0081 Denial of service in NeMo
- CVE-2025-33245 NVIDIA NeMo Framework contains a vulnerability where malicious data could cause remote code execution
- CVE-2026-24252 Command injection in NeMo Framework
- CVE-2026-24155 Code injection in NeMo Framework
- CVE-2026-24228 Deserialization in NeMo Framework
Sources
Also known as GHSA-9hg3-hmmf-c3gr, GHSA-rpx7-33j2-xx9x, PYSEC-2026-685.