Code Injection Vulnerability in NVIDIA Merlin Transformers4Rec
CVE-2025-33233

7.8HIGH

Key Information:

Vendor

Nvidia
Status
Merlin Transformers4rec
Vendor
CVE Published:
20 January 2026

What is CVE-2025-33233?

NVIDIA Merlin Transformers4Rec for all platforms is susceptible to a code injection vulnerability. An attacker leveraging this flaw could potentially execute arbitrary code, which may lead to serious security implications, including unauthorized access, elevated privileges, data modification, and exposure of sensitive information. Organizations must implement strategies to mitigate the risks associated with this vulnerability and ensure the integrity of their systems.

Affected Version(s)

Merlin Transformers4Rec Linux All code branches that do not include commit 27ddd49

References

https://nvd.nist.gov/vuln/detail/CVE-2025-33233
https://www.cve.org/CVERecord?id=CVE-2025-33233
https://nvidia.custhelp.com/app/answers/detail/a_id/5761

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.