CVE-2025-27772: UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.7.1 and prior, the `

UpTrain, an open-source platform for evaluating and improving generative AI applications, has a remote code execution vulnerability (RCE, where an attacker can run commands on a system they don't own) in version 0.7.1 and earlier in its `/new_run` endpoint through the `checks` and `metadata` parameters. Any authenticated user with access to UpTrain can exploit this to execute arbitrary code on the host system, typically a Docker container (a lightweight virtual environment).