CVE-2025-27770: UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.7.1 and prior, the `

UpTrain, an open-source tool for testing and improving AI applications, has a vulnerability in version 0.7.1 and earlier where the `/create_project` endpoint allows remote code execution (the ability to run commands on a system from a remote location) through the `checks` and `metadata` parameters. Any authenticated user with access to UpTrain could potentially execute arbitrary code on the computer or container (a sandboxed environment) running UpTrain.