Preface: According to the NVIDIA security bulletin for runx updated January 23, 2026 – A vulnerability (CVE‑2025‑33234) was found “during End of Support, but prior to End of Life.”
Background: An ML hyperparameter sweep is the automated process of systematically testing different combinations of hyperparameter values for a machine learning model to identify the configuration that yields the best performance. Hyperparameters are external settings that control the learning process, such as the learning rate or number of hidden layers, and must be set before training begins.
NVIDIA runx (Deep Learning Library) – This is a lightweight Python tool used for experiment management and hyperparameter sweeps.
Vulnerability details: CVE-2025-33234 NVIDIA runx contains a vulnerability where an attacker could cause a code injection. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.
Official announcement: Please refer to the link for details – https://nvidia.custhelp.com/app/answers/detail/a_id/5764
Appendix: runx is a local Python script for organizing your personal files, while NVIDIA Run:ai is a cloud-based infrastructure for managing hardware. To move from a local developer environment using runx to an enterprise environment using Run:ai, you must transition from a “local script” workflow to a “containerized” workflow.
Realistic examples where Run:ai WOULD be impacted (conceptual, not exploit details)
Scenario 1
runx injects malicious commands into a Python file your training code imports →
you copy the folder into Docker →
Run:ai runs that code →
the malicious code executes.
Scenario 2
runx generates a poisoned submit_cmd[.]sh or config file →
you include it in the Docker image →
your entrypoint or tools accidentally run it.
Scenario 3
runx modifies your dataset or preprocessing script →
container uses that script →
it runs inside Run:ai.
Reminder: These examples show pollution can travel only if you physically package it into the container.