CVE-2026-65151

Published: Oct 27, 2026Modified: Oct 27, 2026

8.4

Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.5 / Impact: 5.9

Source: psirt@nvidia.com (Secondary)

Description

NVIDIA NeMo Agent Toolkit contains vulnerability where an attacker could cause a SQL injection issue. A successful exploit of this vulnerability might lead to data tampering, denial of service and information disclosure.

Related CWEs

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

References (3)

https://github.com/NVIDIA/product-security/tree/main/2026/5912

Source: psirt@nvidia.com

https://nvd.nist.gov/vuln/detail/CVE-2026-65151

Source: psirt@nvidia.com

https://www.cve.org/CVERecord?id=CVE-2026-65151

Source: psirt@nvidia.com

Timeline

No history available yet.