NVIDIA BioNeMo Core Path Traversal Leads to Code Execution (CVE-2026-24217)

The National Vulnerability Database has disclosed CVE-2026-24217, a high-severity path traversal vulnerability impacting NVIDIA BioNeMo Core for Linux. This flaw, rated 8.8 CVSS, allows an attacker to load a malicious file, potentially leading to arbitrary code execution, denial of service, information disclosure, and data tampering.

This isn’t just a theoretical bug. Path traversal vulnerabilities, especially with high CVSS scores, are routinely exploited in the wild. Attackers leverage these to escape intended directory restrictions, access sensitive files, or drop malicious payloads that facilitate further compromise. The fact that it can lead to code execution is a critical alarm bell.

For defenders, this means NVIDIA BioNeMo Core deployments on Linux are exposed. The attacker’s calculus is straightforward: find exposed instances, upload a crafted file, and gain a foothold. Given the potential for full system compromise, this needs immediate attention.