{"identifier":"CVE-2026-24222","cve":{"id":"CVE-2026-24222","description":"NVIDIA NeMoClaw contains a vulnerability in the sandbox environment initialization component, where a remote attacker could cause improper access control by sending prompt-injected content that causes the agent to read and exfiltrate host environment variables not properly restricted during sandbox creation. A successful exploit of this vulnerability might lead to information disclosure.","published":"2026-04-28T19:36:45.517000+00:00","modified":"2026-10-26T20:10:00.160000+00:00","status":"Analyzed","score":8.6,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","cvss_version":"3.1","affected":[{"criteria":"cpe:2.3:a:nvidia:nemoclaw:*:*:*:*:*:*:*:*","versionStartIncluding":"","versionStartExcluding":"","versionEndIncluding":"","versionEndExcluding":"0.0.18"}],"weaknesses":["CWE-497"],"references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-24222","source":"psirt@nvidia.com","tags":["US Government Resource"]},{"url":"https://nvidia.custhelp.com/app/answers/detail/a_id/5837","source":"psirt@nvidia.com","tags":["Vendor Advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-24222","source":"psirt@nvidia.com","tags":["Third Party Advisory"]}],"kev":null,"kev_checked":true,"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":4.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-04-29T13:51:53.035168Z","id":"CVE-2026-24222","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:nvidia:nemoclaw:*:*:*:*:*:*:*:*","versionEndExcluding":"0.0.18","matchCriteriaId":"48E4DA43-5E4A-419B-BD40-D2DF1FB1F035"}]}]}],"source":"nvd","retrieved_at":"2026-10-28T10:19:46.846383+00:00","exploited":false,"kev_stale":false,"products":["nvidia / nemoclaw"],"priority":{"label":"Assess exposure and vendor guidance","reasons":["No higher-priority signal is available in the current stored evidence."]},"epss":{"probability":0.00395,"percentile":0.33555,"date":"2026-10-28","stale":false},"version_assessment":null},"news":[],"campaigns":[],"domains":[{"domain":"nvd.nist.gov","source_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-24222","investigate_url":"https://investigate.aeglixmind.com/#nvd.nist.gov"},{"domain":"nvidia.custhelp.com","source_url":"https://nvidia.custhelp.com/app/answers/detail/a_id/5837","investigate_url":"https://investigate.aeglixmind.com/#nvidia.custhelp.com"},{"domain":"www.cve.org","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-24222","investigate_url":"https://investigate.aeglixmind.com/#www.cve.org"}],"arsenal_url":"https://arsenal.aeglixmind.com/?cve=CVE-2026-24222","catalog_url":"https://cves.aeglixmind.com/cve/CVE-2026-24222","research_url":"https://investigate.aeglixmind.com/research/cve/CVE-2026-24222","coverage":{"news_candidates_checked":0,"campaign_candidates_checked":0,"bounded":false,"notice":"Exact CVE mentions in stored public excerpts and reviewed campaign content only. A mention is not proof of exploitation, attribution or tool suitability. Missing matches do not establish absence."}}