NVIDIA Isaac Lab: eval injection allows code execution from attacker-influenced input

Impact

Isaac Lab evaluates attacker-influenceable input, so anyone who can supply the content it processes - a config, a task or environment definition, or a training artefact - gets code execution as the user running the training or simulation job. NVIDIA states the exploit can also lead to information disclosure, data tampering and denial of service. On a shared GPU fleet that means a submitted job payload, rather than an account on the node, becomes the entry point: the resulting process holds the job's GPU devices and whatever dataset, checkpoint and registry credentials are mounted into it. The record scores it local with user interaction required, which fits a researcher or pipeline opening a file supplied by someone else rather than an unauthenticated network path.

Who can reach it

Local, with user interaction - an attacker must get an Isaac Lab user or an automated training pipeline to load input the attacker controls. No prior authentication on the node is required; submitting the input is sufficient where a pipeline ingests it automatically.

What to do

Apply the update described in NVIDIA's advisory at github.com/NVIDIA/product-security/tree/main/2026/5902; the NVD record does not name the fixed version, so take it from the advisory. This is a Python framework on the node, not a privileged service: update the installed package or container image and restart the affected training/simulation jobs. No node drain, reboot or firmware work is involved. Until then, treat Isaac Lab configs and task definitions as untrusted code and run them only in jobs isolated from fleet credentials.

References

Related entries

• NVIDIA Isaac Lab: A deserialization flaw reaches code executionCVE-2025-33210 · NVIDIA Isaac LabCritical
• NVIDIA Model-Optimizer: deserialization of untrusted data leads to code executionCVE-2026-65142 · NVIDIA Model-Optimizer (model/checkpoint deserialization)High
• NVIDIA NeMo: a crafted model_config.yaml injects unsafe parameters into dataset loadingCVE-2026-65178 · NVIDIA NeMo (dataset-loading workflow, model_config.yaml parameter injection)High
• PyTorch (flatbuffer model parsing, torch::load / parse_and_initialize_mobile_module): MALICIOUS MODEL FILE TO MEMORYNCVD-2025-019-pytorch-flatbuffer-model-parsing · PyTorch (flatbuffer model parsing, torch::load / parse_and_initialize_mobile_module)High
• LangChain (Web Research Retriever): SSRFCVE-2024-3095 · LangChain (Web Research Retriever)High
• LangGraph MongoDB checkpoint and store: filter dicts allow MQL operator injection across tenantsCVE-2026-55253 · langgraph-checkpoint-mongodb / langgraph-store-mongodb (MongoDBSaver.list, MongoDBStore.search filters)High