CVE-2025-33183CWE-94code-injection

CVE-2025-33183

High · published November 18, 2025

CVSS v3.1
7.8
EPSS
0%
Percentile
41.2
In the wild
Unconfirmed
What it is

⚡ A crafty attacker could sneak their way in through a Python component in NVIDIA Isaac-GR00T, leading to some serious trouble! 🔥 Think of it like a chef gaining access to a kitchen and swapping out ingredients on the fly, potentially ruining a dish — or in this case, your system! If exploited, this vulnerability could allow attackers to execute arbitrary code, escalate their privileges, and even tamper with or disclose sensitive information. The ramifications could be devastating as it jeopardizes the integrity and confidentiality of your data.

Put simply

Think of it like a chef gaining access to a kitchen and swapping out ingredients on the fly, potentially ruining a dish — or in this case, your system! This code injection vulnerability in NVIDIA Isaac-GR00T arises from insufficient input validation in a Python component, allowing attackers to execute malicious scripts under the guise of legitimate operations.

What to do

If exploited, this vulnerability could allow attackers to execute arbitrary code, escalate their privileges, and even tamper with or disclose sensitive information. The ramifications could be devastating as it jeopardizes the integrity and confidentiality of your data. To protect your systems, immediately update to the latest version of NVIDIA Isaac-GR00T, which contains the necessary security patches. Additionally, review your code for any unrelated input validation risks that could lead to similar vulnerabilities. You’ve got this! Follow these steps to secure your environment and keep those attackers at bay! 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00490 · 41.2th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2025-11-18T22:16Z
References (3)
EPSS history
Timeline
  • 18 NOV 16:57Z
    NVIDIA Isaac-GR00T for all platforms contains a vulnerability in a Python component, where an attacker could cause a code injection issue
    cvelistv5