CVE-2026-65096

Analyzed Analyzed - Analysis Complete

NVIDIA NemoClaw Telegram Bridge OS Command Injection

Publication date: 2026-08-25

Last updated on: 2026-09-01

Assigner: NVIDIA Corporation

Description

NVIDIA NemoClaw for Linux contains a vulnerability in the Telegram bridge component, where an attacker could cause an OS command injection. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure, and data tampering.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-25

Last Modified

2026-09-01

Generated

2026-09-15

AI Q&A

2026-08-26

EPSS Evaluated

2026-09-14

NVD

CVE-2026-65096

Affected Vendors & Products

Vendor	Product	Version / Range
nvidia	nemoclaw	0.0.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This vulnerability is an OS command injection flaw in NVIDIA NemoClaw for Linux, specifically in the Telegram bridge component. An attacker could exploit this to execute arbitrary commands on the system.

Detection Guidance

Detecting this vulnerability requires checking for vulnerable versions of NVIDIA NemoClaw on Linux systems. Inspect installed packages using commands like 'dpkg -l | grep nemoclaw' or 'rpm -qa | grep nemoclaw'. Verify if the Telegram bridge component is running and exposed to network interfaces using 'netstat -tulnp | grep nemoclaw' or 'ss -tulnp | grep nemoclaw'.

Impact Analysis

Exploitation could lead to code execution, privilege escalation, unauthorized information disclosure, and data tampering. This may allow attackers to take control of affected systems or steal sensitive data.

Compliance Impact

This vulnerability could lead to information disclosure and data tampering, which may violate GDPR's data protection requirements and HIPAA's safeguards for protected health information if exploited.

Mitigation Strategies

Update NVIDIA NemoClaw to the latest version to address the command injection vulnerability in the Telegram bridge component. Disable the Telegram bridge if not required. Restrict network access to the vulnerable component and monitor for unusual activity.

Hi! I’m here to help you understand CVE-2026-65096. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70