EUVD-2026-98545
GHSA-v3vx-7g26-h7m2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver malicious config/script to user
-
DeliveryUser loads file in Isaac Lab
-
ExploitTainted string reaches eval()
-
ExecutionArbitrary Python executes as user
-
ImpactExfiltrate data or crash process
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Eval input sanitization
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an attacker-controlled string to reach an eval()/exec() call in Isaac Lab, and - per AV:L and UI:R - the attacker must get a local user to open, load, or run the malicious input (for example a crafted experiment configuration, task/environment definition, or command-line parameter) on a system running Isaac Lab. The exact vulnerable feature or parameter is not named in the available description, so the specific entry point cannot be confirmed. Limiting factors: no remote network path (local vector), mandatory user interaction, execution confined to the invoking user's privileges (S:U, no privilege escalation implied), and a small installed base of robotics researchers/developers rather than mass-deployed servers. |
| Impact | This is an eval injection flaw (CWE-95) in NVIDIA Isaac Lab, scored CVSS 7.8 (HIGH) with vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The signals are internally consistent and point to a LOCAL, user-interaction-dependent issue rather than a remotely-wormable one: the LOCAL attack vector (AV:L) combined with required user interaction (UI:R) means an operator must be induced to load or run attacker-controlled input (e.g., a malicious config, script argument, or data file) on a machine where Isaac Lab runs. Despite PR:N, the practical barrier is the UI:R requirement plus the need for local execution context. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so there is no evidence of active or widespread exploitation - the high base score derives from the triple-H technical impact (code execution, information disclosure, data tampering, DoS all explicitly cited), not from demonstrated exploitability. Net: a genuine code-execution bug worth patching for Isaac Lab users, but its real-world urgency is moderate given the local/UI-dependent vector and the niche, research-oriented deployment footprint - not a drop-everything internet-facing emergency. Missing signals (EPSS/KEV/POC absent) should be read as 'not yet characterized,' not as 'safe.' |
| Exploit ScenarioDerived | An attacker crafts a malicious configuration, environment definition, or input file containing a Python expression and convinces an Isaac Lab user to load or execute it locally (e.g., via a shared robotics training scene or experiment config). When Isaac Lab evaluates the attacker-controlled string via eval(), arbitrary code runs with the user's privileges, enabling code execution, data theft, tampering, or crashing the process. No public exploit code is identified in the provided data, and local access plus user interaction are required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Eval injection in NVIDIA Isaac Lab allows a local attacker who can supply crafted input - such as a malicious experiment configuration, task/environment definition, or command-line parameter - to achieve arbitrary code execution, information disclosure, data tampering, and denial of service once a user opens, loads, or runs the content. The flaw is rated CVSS 7.8 (HIGH) with vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H: no privileges are required (PR:N) but the victim must interact with the malicious input (UI:R), the attack path is local (AV:L), and impact is scoped to the invoking user (S:U), so no privilege escalation is implied. The CPE entry is a wildcard with no version boundary and no fixed version is published in the available data, so all Isaac Lab releases should be treated as potentially affected; no public exploit code and no confirmed active exploitation have been identified at time of analysis.
RemediationAI
No vendor-released patch or fixed version is identified in the available data, so the first step is to monitor the NVIDIA product-security advisory (https://github.com/NVIDIA/product-security/tree/main/2026/5902) and the NVD/CVE records for a patched release and upgrade to it as soon as NVIDIA publishes one; do not assume any version is safe in the interim. Until then, apply targeted compensating controls that address the eval-injection primitive: treat all Isaac Lab configuration, task/environment definitions, and startup scripts as executable code and only load files from trusted, version-controlled sources - refusing or manually reviewing configuration received from other users, downloads, or attachments removes the UI:R delivery path and is the single most effective mitigation, at the cost of convenience in collaborative workflows. Run Isaac Lab inside a container or VM under a dedicated low-privilege account with no access to production credentials, SSH keys, cloud tokens, or shared network storage, which limits code execution to a disposable environment but can break GPU passthrough, Omniverse/USD asset paths, and multi-user simulation setups if configured too restrictively. Where a specific configuration or utility can be shown to route strings into eval()/exec(), disable it or convert it to a safe parser such as ast.literal_eval for literal data or a strict allowlisted schema, though this requires code changes and testing against existing task definitions. Finally, review Isaac Lab's configuration-loading path for eval-style calls and restrict write access to config directories so untrusted files cannot be planted for another local user to open; note that broad application allow-listing or sandboxing may degrade simulator performance and is a trade-off, not a substitute for the vendor fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-95, Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection'). Isaac Lab is NVIDIA's GPU-accelerated reinforcement-learning and robotics-simulation framework built on Isaac Sim/Omniverse, and it is driven heavily by Python and by structured configuration (task definitions, environment/experiment configs, and CLI or Hydra-style parameters) that are resolved into Python objects at runtime. Where an attacker-controlled string reaches a Python eval()/exec() call, the string is executed as code in the interpreter running Isaac Lab rather than being treated as inert data, giving the attacker whatever the invoking user can do: reading files and environment secrets (C:H), modifying simulation states, training data, or scripts (I:H), and crashing the process or exhausting resources (A:H). Because the primitive is local and the framework resolves configuration on load, the practical delivery vector is a shared or downloaded config/task file or script that a researcher opens in their own session. The available description does not name the specific vulnerable function or parameter, so the exact entry point cannot be confirmed; the analysis is bounded by the local vector, mandatory user interaction, and unchanged privileges (S:U). No EPSS score or KEV listing was provided in the source data.
Know when Isaac Lab gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Eval injection runs code as the current user and needs no prior auth (PR:N) but requires loading attacker input locally, so AV:L and UI:R; full C/I/A impact since arbitrary code results.
Primary rating from Vendor (nvidia).
CVSS VectorVendor: nvidia
DescriptionCVE.org
NVIDIA Isaac Lab contains a vulnerability where an attacker could cause an eval injection. A successful exploit of this vulnerability might lead to code execution, information disclosure, data tampering, and denial of service.
Articles & Coverage 1
Executive ViewAI
NVIDIA Isaac Lab, a robotics simulation framework used by AI and robotics teams, contains a high-severity eval injection flaw (CVE-2026-65141) that allows a local attacker to execute arbitrary code when a user opens or runs a crafted configuration, task definition, or command-line parameter. This puts developers and researchers who use Isaac Lab at risk of data theft, tampering, and denial of service on their workstations, and no vendor-released patch identified at time of analysis. Leadership should prioritize mitigating this risk because it can compromise intellectual property and disrupt critical robotics development without requiring any special privileges.
No vendor-released patch identified at time of analysis. Interim mitigations include: restricting Isaac Lab to process untrusted inputs only in isolated sandboxes or containers with minimal privileges; disabling or safely wrapping eval and dynamic code execution features where possible; enforcing application allowlisting to prevent execution of untrusted configuration files; monitoring for anomalous child processes or file writes from Isaac Lab; and conducting user awareness training to avoid opening unknown experiment configurations or task definitions.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB