CVE-2026-24222: NVIDIA Nemoclaw

High severity, CVSS 8.6. EPSS: 0.4% chance of exploitation in the next 30 days.

NVIDIA NeMoClaw contains a vulnerability in the sandbox environment initialization component, where a remote attacker could cause improper access control by sending prompt-injected content that causes the agent to read and exfiltrate host environment variables not properly restricted during sandbox creation. A successful exploit of this vulnerability might lead to information disclosure.

Affected products

• NVIDIA Nemoclaw: before 0.0.18 (fixed in 0.0.18)

Published 2026-04-28. Last modified 2026-06-17.