CVE-2025-33184 Overview
NVIDIA Isaac-GR00T contains a code injection vulnerability [CWE-94] in a Python component across all supported platforms. An attacker with local access and low privileges can inject and execute arbitrary code within the application's execution context. Successful exploitation can lead to code execution, privilege escalation, information disclosure, and data tampering.
The flaw affects the humanoid robot foundation model framework used for robotics research and development. NVIDIA published guidance in NVIDIA Support Answer 5725.
Critical Impact
Local attackers can achieve code execution with high impact to confidentiality, integrity, and availability across affected Isaac-GR00T deployments.
Affected Products
- NVIDIA Isaac-GR00T (all platforms)
- Python component within the Isaac-GR00T framework
- Deployments used for humanoid robot foundation model workloads
Discovery Timeline
- 2025-11-18 - CVE-2025-33184 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-33184
Vulnerability Analysis
The vulnerability is classified under CWE-94: Improper Control of Generation of Code. A Python component in Isaac-GR00T processes attacker-influenced input without sufficient validation. That input is then evaluated or interpreted as executable code, allowing an authenticated local user to inject arbitrary Python statements.
Exploitation runs in the security context of the Isaac-GR00T process. If the process runs with elevated permissions, the attacker can escalate privileges on the host. The attacker can also read sensitive model artifacts, training data, or credentials, and modify robot control logic.
Root Cause
The root cause is unsafe handling of untrusted input inside a Python component of Isaac-GR00T. Code injection typically arises when input reaches dynamic evaluation primitives such as eval, exec, pickle.loads, yaml.load, or when configuration files control import paths. NVIDIA has not published the specific sink in the public advisory.
Attack Vector
The attack vector is local and requires low privileges without user interaction. An attacker with an account on the host running Isaac-GR00T supplies crafted input to the vulnerable component. The component then executes the attacker-controlled Python code within the application process, delivering high impact across confidentiality, integrity, and availability.
No verified public proof-of-concept code is available. See the NVD entry for CVE-2025-33184 and the CVE.org record for authoritative technical references.
Detection Methods for CVE-2025-33184
Indicators of Compromise
- Unexpected child processes spawned by Isaac-GR00T Python interpreters, particularly shells, curl, wget, or compilers.
- New or modified Python files, pickle artifacts, or YAML configuration files in Isaac-GR00T directories written by non-administrative users.
- Outbound network connections from the Isaac-GR00T process to untrusted hosts.
- Anomalous read access to model weights, training datasets, or credential files by the Isaac-GR00T process.
Detection Strategies
- Monitor process lineage for Python processes associated with Isaac-GR00T executing interpreters, shells, or package managers.
- Alert on file writes to Isaac-GR00T installation and configuration directories from non-privileged users.
- Baseline network egress from the Isaac-GR00T host and flag deviations, especially to previously unseen destinations.
Monitoring Recommendations
- Enable command-line and process-tree logging on Linux hosts running Isaac-GR00T using auditd or eBPF-based sensors.
- Forward host telemetry to a centralized data lake so analysts can correlate local activity with identity and network events.
- Track integrity of Python site-packages, model files, and startup scripts with periodic hash comparisons.
How to Mitigate CVE-2025-33184
Immediate Actions Required
- Apply the fixed release referenced in NVIDIA Support Answer 5725 as soon as it is available in your environment.
- Restrict local access to hosts running Isaac-GR00T to trusted administrators and required service accounts only.
- Run Isaac-GR00T under a dedicated, least-privileged service account rather than root or a shared developer account.
- Audit existing Isaac-GR00T installations for unauthorized modifications to Python modules and configuration files.
Patch Information
Refer to NVIDIA Support Answer 5725 for the vendor's official remediation guidance and fixed component versions. Track updates through the NVD entry, which is the authoritative record for advisory changes.
Workarounds
- Isolate Isaac-GR00T workloads on dedicated hosts or containers with strict filesystem and network policies.
- Disable or restrict interactive access to any Isaac-GR00T interface that accepts user-supplied Python, configuration, or serialized data.
- Enforce read-only mounts for model and configuration directories where operationally feasible.
- Require code review and integrity checks for any configuration or plugin files loaded by Isaac-GR00T.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
