{"action":"Upgrade nemo-toolkit to 1.6.0 or later.","affected":[{"fixed":"1.6.0","introduced":"0"}],"component":"nemo-toolkit","cve_ids":["CVE-2022-22821"],"ecosystem":"PyPI","epss":0.0031,"exploited":false,"fixed_versions":["1.6.0"],"ghsa_id":"GHSA-rpx7-33j2-xx9x","id":"tcs_01M5KFYDVJV6GY27N0DHSZ9EVV","modified_at":"2026-07-08T06:49:39.314731245Z","published_at":"2022-02-15T01:57:18Z","references":["https://osv.dev/vulnerability/GHSA-rpx7-33j2-xx9x","https://github.com/NVIDIA/NeMo/security/advisories/GHSA-rpx7-33j2-xx9x","https://github.com/NVIDIA/NeMo/commit/f7e4ed7e4f7f2fa43765a38c2fafa1b6d1ebd7c0","https://github.com/NVIDIA/NeMo"],"severity":{"label":"low","score":2},"sources":[{"source":"osv","source_id":"GHSA-rpx7-33j2-xx9x","url":"https://osv.dev/vulnerability/GHSA-rpx7-33j2-xx9x"}],"summary":"Arbitrary file deletion in NeMo ASR webapp"}