mirror of
https://github.com/semantica-agi/semantica.git
synced 2026-09-13 04:04:09 +00:00
Mohd Kaif
d8822198cf
Merging #1357 surfaced a real (not crashed) Safety finding: cuda-toolkit 13.0.3.0 < 13.1.0 is affected by SFTY-20260120-40557 / CVE-2025-33228. This can't be fixed with a version bump on our end: torch 2.13.0 (the latest release on PyPI - there is no newer one) hard-pins `cuda-toolkit[cublas,cudart,cufft,cufile,cupti,curand,cusolver,cusparse, nvjitlink,nvrtc,nvtx]==13.0.3` on Linux via its own METADATA, not a loose transitive requirement we control. The underlying CVE is OS command injection in NVIDIA Nsight Systems' gfx_hotspot recipe (process_nsys_rep_cli.py), which requires a human to manually invoke that script with an attacker-supplied string. It isn't reachable from any Semantica code path, and Nsight Systems isn't even part of the extras torch requests here (cublas/cudart/cufft/cufile/ cupti/curand/cusolver/cusparse/nvjitlink/nvrtc/nvtx - no Nsight extra among them). Ignoring this one vulnerability ID only (not the whole package or a blanket policy) so CI reflects actionable risk. Re-evaluate once torch ships a release that pins a patched cuda-toolkit.