CVE-2025-33184CWE-94code-injection

CVE-2025-33184

High · published November 18, 2025

CVSS v3.1
7.8
EPSS
0%
Percentile
41.2
In the wild
Unconfirmed
What it is

⚡ A crafty code injection vulnerability lurks within NVIDIA Isaac-GR00T's Python component, waiting to be exploited! Think of it like a sneaky chef who adds their own secret ingredient to a recipe without anyone noticing — if they can inject their code, they could change the whole dish! If an attacker successfully exploits this vulnerability, they could execute arbitrary code, escalate their privileges, and even tamper with or steal sensitive data. It's like giving a stranger the keys to your kitchen and allowing them to cook whatever they want — absolutely dangerous and chaotic!

Put simply

Think of it like a sneaky chef who adds their own secret ingredient to a recipe without anyone noticing — if they can inject their code, they could change the whole dish! This vulnerability in NVIDIA Isaac-GR00T allows attackers to execute malicious code due to improper input handling in a Python component, which could lead to privilege escalation and data manipulation.

What to do

If an attacker successfully exploits this vulnerability, they could execute arbitrary code, escalate their privileges, and even tamper with or steal sensitive data. It's like giving a stranger the keys to your kitchen and allowing them to cook whatever they want — absolutely dangerous and chaotic! Update NVIDIA Isaac-GR00T to the latest version immediately to patch this vulnerability. Ensure that input validation is robust and implement security best practices for code execution. Conduct a thorough audit of your installations to identify any potential exposure. You've got this! With these steps, you'll be well on your way to securing your environment. 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00490 · 41.2th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2025-11-18T22:16Z
References (3)
EPSS history
Timeline
  • 18 NOV 16:57Z
    NVIDIA Isaac-GR00T for all platforms contains a vulnerability in a Python component, where an attacker could cause a code injection issue
    cvelistv5