What is the CVSS score of CVE-2025-33213?

CVE-2025-33213 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.7%.

Which versions of Transformers4Rec are affected by CVE-2025-33213?

NVIDIA Merlin Transformers4Rec Trainer on Linux contains a high-severity deserialization flaw that can let an attacker execute code, tamper with data, or cause outages when a user loads a malicious…

How to fix or mitigate CVE-2025-33213?

Within 24 hours: inventory all Linux systems running NVIDIA Merlin Transformers4Rec Trainer, referencing the exact affected versions in NVIDIA advisory answer ID 5739, and immediately block ingestion of untrusted or externally sourced model/checkpoint artifacts. Within 7 days: enforce strict provenance and integrity validation for all serialized artifacts, run Trainer workloads in isolated sandboxes with least-privilege accounts and restricted outbound network access, and enable monitoring for suspicious deserialization or process creation. Within 30 days: migrate to a fixed release once available, and if NVIDIA confirms affected versions, apply the vendor-released patch immediately; until then, maintain artifact quarantine and review all externally sourced checkpoints. Note: no vendor-released patch identified at time of analysis and no public exploit identified at time of analysis.

Transformers4Rec CVE-2025-33213

HIGH

Deserialization of Untrusted Data (CWE-502)

2025-12-09 psirt@nvidia.com

RCE Denial Of Service Information Disclosure Deserialization Nvidia

8.8

CVSS 3.1 · Vendor: nvidia

Severity by source

Vendor (nvidia) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Unauthenticated (PR:N) but requires victim to load a malicious serialized artifact (UI:R); low-complexity CWE-502 deserialization yielding code execution gives C/I/A:H.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (nvidia).

CVSS VectorVendor: nvidia

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Oct 08, 2026 - 10:34 vuln.today

CVE Published

Dec 09, 2025 - 18:15 cve.org

HIGH 8.8

DescriptionCVE.org

NVIDIA Merlin Transformers4Rec for Linux contains a vulnerability in the Trainer component, where a user could cause a deserialization issue. A successful exploit of this vulnerability might lead to code execution, denial of service, information disclosure, and data tampering.

AnalysisAI

Deserialization of untrusted data in the NVIDIA Merlin Transformers4Rec Trainer component on Linux can allow an attacker to achieve code execution, denial of service, information disclosure, and data tampering, with a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). No attacker authentication is required, but exploitation depends on the victim loading or processing an attacker-controlled serialized artifact (model or checkpoint) through the Trainer - the mandatory victim action captured by the UI:R metric. There is no public exploit identified at time of analysis and the EPSS score is low (0.66%, ~50th percentile), so risk is concentrated in environments that ingest untrusted or externally sourced checkpoints; confidential NVIDIA advisory answer ID 5739 should be consulted for the exact affected versions and the specific serialization mechanism.

Technical ContextAI

The vulnerability is a classic insecure deserialization flaw (CWE-502) in the Trainer component of NVIDIA Merlin Transformers4Rec, a library for building sequential and session-based recommendation models on top of PyTorch/HuggingFace Transformers. In such Python ML stacks, models, checkpoints, and related artifacts are frequently persisted and reloaded via serialization formats - most commonly pickle or framework wrappers around it - which can execute arbitrary code at load time if the payload is attacker-controlled. The CVSS vector (AV:N/AC:L/PR:N/UI:R) indicates the flaw is network-reachable with low attack complexity and no privileges required, but that a user must trigger the deserialization path, typically by opening, importing, or training from a malicious checkpoint supplied by an adversary. The provided data does not identify the exact affected versions or the precise serialization mechanism involved; those details must be confirmed against NVIDIA's advisory (custhelp answer ID 5739). The CPE data was not supplied, so affected product/version mapping should be validated from the vendor advisory rather than inferred.

Affected ProductsAI

NVIDIA Merlin Transformers4Rec for Linux, specifically the Trainer component, is the affected product according to the vendor-reported advisory. Exact version ranges, patch boundaries, and CPE identifiers were not provided in the available input data, so the authoritative scope must be confirmed via the NVIDIA security bulletin at https://nvidia.custhelp.com/app/answers/detail/a_id/5739 and the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2025-33213. Because deployment of Transformers4Rec is typically through PyPI packages or the NVIDIA Merlin container images, operators should treat any installation version predating the fixed release named in the NVIDIA advisory as potentially affected and verify their installed version against the vendor matrix before assuming exposure. Environments on Linux that build or fine-tune recommendation models from externally sourced checkpoints are the primary exposure profile.

RemediationAI

No vendor-released patch was identified in the provided input data at time of analysis; the definitive fix version and release guidance must be confirmed from NVIDIA advisory answer ID 5739 (https://nvidia.custhelp.com/app/answers/detail/a_id/5739) and the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2025-33213), which should be monitored for an updated fixed release. Until a patched version is confirmed and deployed, apply the following compensating controls with their trade-offs: first, treat all model checkpoints and serialized artifacts as untrusted input and only load artifacts from trusted, integrity-verified (e.g., cryptographically signed and hash-checked) sources - this is the single most effective control because the flaw requires the deserialization path to be invoked, but it requires strict supply-chain discipline and breaks workflows that ingest community or third-party checkpoints. Second, where the framework supports it, force safe deserialization modes (for example PyTorch's weights_only loading or switching to formats such as safetensors) - this removes the code-execution primitive but can break models that rely on arbitrary pickle objects and may not be supported by every Transformers4Rec code path. Third, run training and inference workloads that must touch untrusted artifacts inside a sandboxed, least-privilege container or VM with no access to production credentials, mounted secrets, or sensitive datasets - this limits the blast radius of code execution and data tampering but adds operational overhead and does not prevent denial of service. Fourth, restrict network exposure of training services and block inbound access to any endpoint that accepts serialized artifacts from untrusted networks - this reduces the AV:N reachability but does not help when the malicious artifact arrives via another channel such as a downloaded dataset or model hub. Finally, monitor advisory 5739 for the official fixed version and upgrade as soon as it is published, since these workarounds do not remove the underlying CWE-502 defect.