Vulnerability · Published Nov 25, 2025 · Assigned by nvidia
CVE-2025-33203
High 7.6
In plain English
A high-severity server-side request forgery in NeMo Agent ToolKit from NVIDIA. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities).
Severity (CVSS 3.1)7.6High
Exploit odds (30 days)0.3%top 75.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
NVIDIA NeMo Agent Toolkit UI for Web contains a vulnerability in the chat API endpoint where an attacker may cause a Server-Side Request Forgery. A successful exploit of this vulnerability may lead to information disclosure and denial of service.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| NVIDIA | NeMo Agent ToolKit | All versions prior to 1.3.0 |
Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L