CVE-2025-27771: UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.7.1 and prior, the `

UpTrain, an open-source platform for evaluating AI applications, has a critical vulnerability in version 0.7.1 and earlier where the `/add_prompts` endpoint allows remote code execution (RCE, where an attacker can run commands on a system they don't own) through the `checks` and `metadata` parameters. Any authenticated user with access to UpTrain can exploit this to run arbitrary code on the host machine, typically within a Docker container (a lightweight isolated computing environment).