Code Injection Flaws Threaten NVIDIA’s Isaac-GROOT Robotics Platform

NVIDIA has issued a security update to address two high-severity vulnerabilities in its Isaac-GROOT robotics software, an open foundation model for humanoid robot reasoning and skills. The flaws, tracked as CVE-2025-33183 and CVE-2025-33184, originate in a Python component and could enable code execution, privilege escalation, information disclosure, or data tampering if exploited.

Both vulnerabilities carry a High severity rating with a Base Score of 7.8, and a root cause described as a weakness in the Python component where an attacker could cause a code injection issue. The affected product is NVIDIA Isaac-GROOT N1.5 on all platforms, with the condition that versions must include code commit 7f53666 to be safe; all other versions are exposed.

NVIDIA urges users and developers relying on Isaac-GROOT to update immediately, as the fix is included in any code branch that contains code commit 7f53666. Patch management is essential to secure ongoing robotics development and deployment projects.