Merlin Transformers4Rec: RCE via unsanitized input
CVSS 7.8CVE-2025-33233NVIDIA / GPU stackcurated
Impact
RCE via unsanitized input
Who can reach it
Malicious model/dataset
What to do
Bump the package; rebuild recsys images
References
Related entries
- NVIDIA runx: Arbitrary command exec via shell metacharacter injectionCVE-2025-33234 · NVIDIA runxHigh
- NVIDIA Resiliency Extension: A race condition in the checkpointing core reaches information disclosure, data tamperingCVE-2025-33235 · NVIDIA Resiliency ExtensionHigh
- NeMo Framework: Arbitrary Python code exec via code injectionCVE-2025-33236 · NeMo FrameworkHigh
- Megatron-Bridge: code injection via malicious input in the data merging and data shuffling tutorialsCVE-2025-33239 · Megatron-BridgeHigh
- NeMo Framework: Unsafe deserialization of untrusted model/config data allows arbitrary code executionCVE-2025-33241 · NeMo FrameworkHigh
- NeMo Framework: Local command injection via unsanitized input passed to shell executionCVE-2025-33246 · NeMo FrameworkHigh
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.