AI Threat Alert
CVE-2025-33213
HIGHNVIDIA Merlin Transformers4Rec contains a high-severity deserialization flaw (CWE-502) in its Trainer component enabling remote code execution when a user loads a malicious artifact. If your ML teams use this library for transformer-based recommendation systems, patch immediately via NVIDIA advisory ID 5739. Until patched, restrict Trainer inputs to internally signed, verified sources only and sandbox training workloads.
Severity & Risk
Recommended Action
- 1. Patch: Apply NVIDIA's fix immediately per advisory https://nvidia.custhelp.com/app/answers/detail/a_id/5739. 2. Inventory: Audit all environments running Merlin Transformers4Rec Trainer across dev, staging, and production. 3. Restrict inputs: Enforce strict allowlists on model checkpoint and artifact sources; only load files from internally verified, cryptographically signed repositories. 4. Isolate training workloads: Run training jobs in sandboxed containers with restricted syscalls (seccomp/AppArmor) to limit blast radius. 5. Detect: Monitor for unexpected process spawning, outbound network connections, or anomalous file writes from training processes; alert on deserialization of externally sourced pickle/joblib files. 6. Audit MLOps pipelines: Identify any automated pipeline that ingests unvalidated model artifacts from external or user-supplied sources and gate with artifact validation.
Classification
Compliance Impact
This CVE is relevant to:
Technical Details
NVD Description
NVIDIA Merlin Transformers4Rec for Linux contains a vulnerability in the Trainer component, where a user could cause a deserialization issue. A successful exploit of this vulnerability might lead to code execution, denial of service, information disclosure, and data tampering.
Exploitation Scenario
An adversary crafts a malicious serialized Python object (via pickle) embedded in a model checkpoint file for a transformer-based recommendation model. They distribute it through a poisoned model registry, a shared S3 bucket with lax permissions, or a spearphishing email with a convincing 'pre-trained Merlin model for fine-tuning' attachment. When an ML engineer loads the artifact into the Trainer component for fine-tuning or evaluation, deserialization fires arbitrary code execution on their training host — which typically has privileged access to internal data lakes, cloud storage credentials, and GPU cluster orchestration APIs. The adversary exfiltrates training data, implants a persistent backdoor in the model or training environment, or pivots laterally into the broader MLOps infrastructure.
Weaknesses (CWE)
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H