CVE-2025-33228: OS Command Injection
NVIDIA Nsight Systems contains a vulnerability in the gfxhotspot recipe, where an attacker could cause an OS command injection by supplying a malicious string to the processnsysrepcli.py script if the script is invoked manually. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, denial of service, and information disclosure.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2025-33228?
The severity of CVE-2025-33228 is classified as high due to the potential for OS command injection leading to code execution.
How do I fix CVE-2025-33228?
To fix CVE-2025-33228, ensure that you do not invoke the process_nsys_rep_cli.py script manually with untrusted input.
What software is affected by CVE-2025-33228?
CVE-2025-33228 affects NVIDIA Nsight Systems, specifically through the gfx_hotspot recipe.
What could an attacker achieve by exploiting CVE-2025-33228?
An attacker exploiting CVE-2025-33228 could execute arbitrary OS commands on the affected system.
Is there a workaround for CVE-2025-33228?
Currently, the primary workaround for CVE-2025-33228 is to avoid manual invocation of the vulnerable script with unsafe inputs.