NVIDIA Isaac-GR00T N1: A Python component injects code from crafted input into the robotics-model pipeline

Impact

A Python component injects code from crafted input into the robotics-model pipeline, which in practice runs on GPU cluster nodes. In an AI datacenter this is the model-and-data supply chain problem: the code runs with whatever the training or inference job holds, which is usually a GPU, a service account, and mounted object storage credentials.

Who can reach it

Requires the job to load an attacker-influenced artifact - a checkpoint, .nemo file, config, tokenizer or dataset. Any pipeline that pulls from a public model hub, a customer bucket, or a tenant-supplied path is in scope.

What to do

Bump the package to the fixed version in bulletin 5681 and rebuild every training/inference image that embeds it. Cost: image rebuild and job restart; no host driver or firmware change. The durable control is refusing to deserialize untrusted checkpoints at all - prefer safetensors-style formats and treat pickle-bearing artifacts as executable code.

References

Related entries

• NVIDIA Merlin Transformers4Rec: A Python dependency permits code injection into the recommender training jobCVE-2025-23298 · NVIDIA Merlin Transformers4RecHigh
• NVIDIA NeMo Framework: Deserialization of untrusted data reaches remote code execution when a crafted artifactCVE-2025-23303 · NVIDIA NeMo FrameworkHigh
• NVIDIA NeMo Framework: Loading a .nemo file with crafted metadata injects code at model-load timeCVE-2025-23304 · NVIDIA NeMo FrameworkHigh
• NVIDIA Megatron-LM: A code-injection flaw in the tools component executes attacker-controlled code inside the trainingCVE-2025-23305 · NVIDIA Megatron-LMHigh
• NVIDIA Megatron-LM: megatron/training/arguments.py injects code from malicious inputCVE-2025-23306 · NVIDIA Megatron-LMHigh
• NVIDIA NeMo Curator: A malicious file processed by the data-curation pipeline injects codeCVE-2025-23307 · NVIDIA NeMo CuratorHigh