CVE-2026-24222
High
Description
NVIDIA NeMoClaw contains a vulnerability in the sandbox environment initialization component, where a remote attacker could cause improper access control by sending prompt-injected content that causes the agent to read and exfiltrate host environment variables not properly restricted during sandbox creation. A successful exploit of this vulnerability might lead to information disclosure.
SeverityHigh
CVSS8.6
Exploit probability—
ProductNvidia Nemoclaw
PublishedApr 28, 2026
First seenApr 28, 2026
Weakness typeCWE-497CWE-497
How to fix
Update
- nvidia nemoclaw0.0.18 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| nvidia nemoclaw | v < 0.0.18 | 0.0.18 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.