CVE-2025-33228: OS Command Injection

Published Jan 20, 2026
·
Updated

NVIDIA Nsight Systems contains a vulnerability in the gfxhotspot recipe, where an attacker could cause an OS command injection by supplying a malicious string to the processnsysrepcli.py script if the script is invoked manually. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, denial of service, and information disclosure.

Affected Software

2 affected components
Nvidia Nsight Systems
Nvidia CUDA Toolkit<13.1.0

Event History

Jan 20, 2026
CVE Published
via MITRE·05:44 PM
Data Sourced
via MITRE·05:44 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·06:16 PM
RemedyDescriptionSeverityWeaknessAffected Software
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2025-33228?

The severity of CVE-2025-33228 is classified as high due to the potential for OS command injection leading to code execution.

2

How do I fix CVE-2025-33228?

To fix CVE-2025-33228, ensure that you do not invoke the process_nsys_rep_cli.py script manually with untrusted input.

3

What software is affected by CVE-2025-33228?

CVE-2025-33228 affects NVIDIA Nsight Systems, specifically through the gfx_hotspot recipe.

4

What could an attacker achieve by exploiting CVE-2025-33228?

An attacker exploiting CVE-2025-33228 could execute arbitrary OS commands on the affected system.

5

Is there a workaround for CVE-2025-33228?

Currently, the primary workaround for CVE-2025-33228 is to avoid manual invocation of the vulnerable script with unsafe inputs.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203