CVE-2025-33233CWE-94

NVIDIA Merlin Transformers4Rec for all platforms contains a vulnerability where an attacker could cause code injection

High · published January 20, 2026

CVSS v3.1
7.8
EPSS
0%
Percentile
13.9
In the wild
Unconfirmed
What it is

⚡ A sneaky code injection vulnerability in NVIDIA Merlin Transformers4Rec could let attackers run wild! Just one flaw could lead to a serious compromise! Think of it like a restaurant where a chef accidentally leaves the door wide open. Unscrupulous diners could sneak in and tamper with the recipes, ruining every dish served. That's how this vulnerability works — it allows attackers to inject harmful code and take control. If exploited, this vulnerability could lead to devastating consequences such as unauthorized code execution, privilege escalation, information disclosure, and even data tampering. Imagine an attacker not just stealing your secret sauce but also altering it to ruin your reputation!

Put simply

Think of it like a restaurant where a chef accidentally leaves the door wide open. Unscrupulous diners could sneak in and tamper with the recipes, ruining every dish served. That's how this vulnerability works — it allows attackers to inject harmful code and take control. This vulnerability exists in NVIDIA Merlin Transformers4Rec, where insufficient validation allows an attacker to inject malicious code. This can lead to various critical issues, including unauthorized access and modification of sensitive data.

What to do

If exploited, this vulnerability could lead to devastating consequences such as unauthorized code execution, privilege escalation, information disclosure, and even data tampering. Imagine an attacker not just stealing your secret sauce but also altering it to ruin your reputation! To protect against this vulnerability, it's crucial to update to the latest version of NVIDIA Merlin Transformers4Rec as soon as possible. Regularly audit your application for any signs of compromise and ensure proper input validation across your codebase. You've got this! Follow these steps to shield your systems from harm and keep your data safe! 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00237 · 13.9th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2026-01-20T17:43Z
EPSS history
Timeline
  • 20 JAN 17:43Z
    NVIDIA Merlin Transformers4Rec for all platforms contains a vulnerability where an attacker could cause code injection
    cvelistv5