NVIDIA Isaac Lab is vulnerable to an eval injection that allows a malicious actor to execute arbitrary code. The impact includes code execution, potential disclosure of information, tampering with data, and disruption of service. This weakness, identified as CWE-95, originates from unsanitized evaluator input and can compromise the integrity and availability of the system.

The affected product is NVIDIA Isaac Lab. No specific version information is provided in the current data, so all installations of Isaac Lab should be evaluated for this issue.

The CVSS score of 7.8 indicates a high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting it may not yet be actively exploited. The attack vector is inferred to be through unsanitized input that triggers eval execution; if Isaac Lab is exposed to external inputs, remote exploitation is plausible, otherwise local exploitation would require access to the environment. Given the potential for code execution, the risk is significant for any organization running the application.