We use cookies to improve your experience on our site.
AVID-2026-R1239
Description
CVE (CVE-2023-31036)
Details
NVIDIA Triton Inference Server for Linux and Windows contains a vulnerability where, when it is launched with the non-default command line option –model-control explicit, an attacker may use the model load API to cause a relative path traversal. A successful exploit of this vulnerability may lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.
Reason for inclusion in AVID: CVE-2023-31036 affects NVIDIA Triton Inference Server, a model-serving/runtime component used in AI pipelines. The vulnerability is a software path traversal that can lead to code execution, DoS, privilege escalation, information disclosure, and data tampering. This is clearly a software supply-chain-relevant issue in AI software stacks (AI frameworks/serving components), with explicit security impact.
References
Affected or Relevant Artifacts
- Developer: nvidia
- Deployer: nvidia
- Artifact Details:
| Type | Name |
|---|---|
| System | Triton Inference Server |
Impact
AVID Taxonomy Categorization
- Risk domains: Security
- SEP subcategories: S0100: Software Vulnerability
- Lifecycle stages: L06: Deployment
CVSS
| Version | 3.1 |
| Vector String | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
| Base Score | 7.5 |
| Base Severity | 🔴 High |
CWE
| ID | Description |
|---|---|
| CWE-23 | CWE-23 |
Other information
- Report Type: Advisory
- Credits:
- Date Reported: 2024-01-12
- Version: 0.3.3
- AVID Entry