A critical OS command injection vulnerability in NVIDIA Nsight Systems could allow a local attacker to achieve arbitrary code execution and system compromise.

The vulnerability exists in the gfx_hotspot recipe, specifically within the process_nsys_rep_cli.py script, which fails to properly sanitize input before passing it to an OS command. The CVSS vector indicates that a local user with low privileges (PR:L) can trigger this issue, potentially leading to full system compromise.

Successful exploitation allows an attacker to execute arbitrary code with the privileges of the user running the script, leading to potential data tampering, privilege escalation, or denial of service. Given the CVSS score of 7.3, this represents a significant risk to the integrity and availability of development environments and workstations where the CUDA Toolkit is deployed.

Immediate Action: Update the NVIDIA CUDA Toolkit to version 13.1 or later, as specified in the vendor security advisory.

Proactive Monitoring: Monitor system logs for unusual process executions or unexpected command-line arguments involving the process_nsys_rep_cli.py script.

Compensating Controls: Restrict access to the affected script to only authorized users and ensure that the script is not executed with elevated administrative privileges by default.

Public Exploit Available: No

Organizations utilizing the NVIDIA CUDA Toolkit must prioritize patching to version 13.1 to eliminate this command injection risk. While the vector requires local access, the potential for privilege escalation and full system control warrants immediate remediation across all affected development and production environments.