Isaac Lab
Monthly
Eval injection in NVIDIA Isaac Lab allows a local attacker who can supply crafted input - such as a malicious experiment configuration, task/environment definition, or command-line parameter - to achieve arbitrary code execution, information disclosure, data tampering, and denial of service once a user opens, loads, or runs the content. The flaw is rated CVSS 7.8 (HIGH) with vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H: no privileges are required (PR:N) but the victim must interact with the malicious input (UI:R), the attack path is local (AV:L), and impact is scoped to the invoking user (S:U), so no privilege escalation is implied. The CPE entry is a wildcard with no version boundary and no fixed version is published in the available data, so all Isaac Lab releases should be treated as potentially affected; no public exploit code and no confirmed active exploitation have been identified at time of analysis.
Eval injection in NVIDIA Isaac Lab allows a local attacker who can supply crafted input - such as a malicious experiment configuration, task/environment definition, or command-line parameter - to achieve arbitrary code execution, information disclosure, data tampering, and denial of service once a user opens, loads, or runs the content. The flaw is rated CVSS 7.8 (HIGH) with vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H: no privileges are required (PR:N) but the victim must interact with the malicious input (UI:R), the attack path is local (AV:L), and impact is scoped to the invoking user (S:U), so no privilege escalation is implied. The CPE entry is a wildcard with no version boundary and no fixed version is published in the available data, so all Isaac Lab releases should be treated as potentially affected; no public exploit code and no confirmed active exploitation have been identified at time of analysis.