GitHub Advisoryadvisory · Go

GHSA-vmg3-7v43-9g23 NVIDIA Container Toolkit for all platforms contains an Untrusted Search Path

CRITICAL Published 2025-07-17 Modified 2025-10-23 Official page ↗
Aliases
CVE-2025-23266
Ecosystem
Go
Packages
github.com/NVIDIA/nvidia-container-toolkit, github.com/NVIDIA/k8s-device-plugin, github.com/NVIDIA/gpu-operator, github.com/NVIDIA/mig-parted
Severity
Critical
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Weaknesses
CWE-426
Reviewed
2025-09-30

Affected packages

• Go github.com/NVIDIA/nvidia-container-toolkit: < 1.17.8 → fixed in 1.17.8 • Go github.com/NVIDIA/k8s-device-plugin: < 0.17.3 → fixed in 0.17.3 • Go github.com/NVIDIA/gpu-operator: < 25.3.2 → fixed in 25.3.2 • Go github.com/NVIDIA/mig-parted: < 0.12.2 → fixed in 0.12.2

Description

NVIDIA Container Toolkit for all platforms contains a vulnerability in some hooks used to initialize the container, where an attacker could execute arbitrary code with elevated permissions. A successful exploit of this vulnerability might lead to escalation of privileges, data tampering, information disclosure, and denial of service.

Related

Alias · CVE (1)

  • CVE-2025-23266 NVIDIA Container Toolkit for all platforms contains a vulnerability in some hooks used to initialize the container, where an attacker could… vulnerability

Weakness · CWE (1)

  • CWE-426 Untrusted Search Path weakness

References