Skip to main content

NVIDIA Megatron-LM: Code Injection Across the LLM Training Stack

Code injection vulnerabilities across multiple Megatron-LM Python scripts allowing RCE on training infrastructure.

Stealthium Research TeamJun 24, 20262 MIN

CVE ClusterScoreDisclosed
CVE-2025-23264, CVE-2025-232657.8 High eachJune 2025
CVE-2025-23348, CVE-2025-23349, CVE-2025-23353, CVE-2025-233547.8 High eachSeptember 2025

June 2025 cluster discovered by Yu Rong and Hao Fan.

For executives​

Megatron-LM is NVIDIA's open-source framework for training large language models at scale. Two separate disclosure events revealed code injection vulnerabilities across multiple Python scripts. Malicious data provided to the training system can cause those scripts to execute attacker-controlled code. The consequences are code execution, privilege escalation, information disclosure, and data tampering on training infrastructure.

The vulnerability class​

Python scripts in Megatron-LM construct code segments using input data without adequately sanitising that data — CWE-94 (Improper Control of Generation of Code). A code injection in a Python training script running on a GPU cluster executes with the permissions of the training process, which typically has access to the full model checkpoint directory, the training dataset, the cluster's shared filesystem, and the GPU hardware.

September 2025: four further scripts​

  • CVE-2025-23348: affects the pretrain_gpt script — the core pretraining launcher for GPT-style models
  • CVE-2025-23349: affects the ORQA unsupervised task script
  • CVE-2025-23353: affects the MSDP preprocessing script
  • CVE-2025-23354: affects the ensemble_classifier script

All four carry CVSS 7.8. All produce code execution, privilege escalation, information disclosure, and data tampering.

The attack scenario​

In multi-participant environments — federated training setups, collaborative research clusters, shared compute environments — a malicious participant can craft their contribution to trigger code injection when the training coordinator processes their input.

Patch​

June 2025 cluster: Megatron-LM version 0.12.1 or later. September 2025 cluster: specific commits identified in NVIDIA's September security bulletin.