Executive Summary
- NVIDIA disclosed two critical code injection vulnerabilities in the Isaac-GR00T platform.
- Tracked as CVE-2025-33183 and CVE-2025-33184, the flaws carry a high severity score of 7.8.
- Exploits could allow attackers to execute arbitrary code and escalate privileges.
- Patches have been released, and immediate updates are recommended for all users.
NVIDIA has issued a security advisory disclosing two critical code injection vulnerabilities affecting its Isaac-GR00T robotics platform, which could allow authenticated attackers to execute arbitrary code and escalate privileges, according to the company’s product security team.
The vulnerabilities, officially tracked as CVE-2025-33183 and CVE-2025-33184, both carry a Common Vulnerability Scoring System (CVSS) score of 7.8, indicating a high severity level. NVIDIA stated that the flaws exist within the Python components of the platform and stem from improper handling of user-supplied input. If exploited, these weaknesses could enable an attacker with local access and low-level privileges to gain complete control over the system without requiring user interaction.
According to the advisory, the flaws affect all versions of NVIDIA Isaac-GR00T N1.5 across all platforms. Successful exploitation could result in unauthorized data modification, information disclosure, and the compromise of critical robotic operations in industrial and research settings. The vulnerabilities were responsibly disclosed to NVIDIA by Peter Girnus of the Trend Micro Zero Day Initiative.
In response to the findings, NVIDIA has released a software update addressing the security gaps. The company urges system administrators to apply the patch available through GitHub commit 7f53666 immediately to mitigate potential threats. Organizations unable to patch immediately have been advised to restrict local access to affected systems.
Operational Security Impact
The disclosure highlights the growing necessity for rigorous vulnerability management within operational technology (OT) and autonomous systems. As industries increasingly rely on advanced robotics for automation, the integrity of the underlying software becomes a critical safety vector. Organizations deploying these platforms are advised to isolate affected systems and prioritize the deployment of security updates to prevent potential disruptions to industrial workflows or unauthorized access to sensitive research data.
