A critical OS command injection vulnerability in the NVIDIA Nsight Systems installer for Linux poses a significant risk of privilege escalation and remote code execution for local users.

This vulnerability is an OS Command Injection (CWE-78) flaw within the .run installer. An attacker with local access can supply a malicious string to the installation path to execute arbitrary commands with elevated privileges.

Successful exploitation of this flaw allows a local, authenticated attacker to gain full control over the host system, leading to data tampering, information disclosure, and potential denial of service. With a CVSS score of 7.3, this high-severity vulnerability represents a significant risk to the integrity and availability of development and production environments utilizing the CUDA Toolkit.

Immediate Action: Upgrade to NVIDIA CUDA Toolkit version 13.1 or later to apply the necessary security patches for the Nsight Systems installer.

Proactive Monitoring: Audit system logs for unexpected execution of commands or unusual file creation patterns during software installation processes.

Compensating Controls: Restrict permissions on installation directories and ensure that only trusted users have the ability to execute binary installers on critical Linux infrastructure.

Public Exploit Available: Unknown

Given the potential for privilege escalation and arbitrary code execution, organizations should prioritize updating all instances of the NVIDIA CUDA Toolkit to version 13.1. Administrators must ensure that installation procedures are conducted by authorized personnel in secure environments to minimize the risk of local exploitation until the update is fully deployed.