Model scanners miss threats inside Nvidia .nemo checkpoints

A researcher at Munim released nemo_container_scan.py, an open-source scanner that opens .nemo files from Nvidia NeMo as tar archives and disassembles the nested pickle without extracting or running it. Scanners that don't untar .nemo miss malicious pickles, and NeMo before r2.0.0rc0 had CVE-2024-0129, an arbitrary file write during extraction.

• A .nemo file is a tar bundling model_config.yaml and a pickle-based model_weights.ckpt
• CVE-2024-0129: unsanitised extractall allowed writes outside the output folder, NVD score 7.8
• The scanner never imports torch or NeMo, never extracts to disk and never unpickles
• Released under Apache-2.0, it exits 1 on high-severity findings to gate CI jobs