CVE-2025-27771 in UpTrain
Summary
by MITRE • 08/17/2026
UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.7.1 and prior, the `/add_prompts` endpoint is vulnerable to remote code execution via the `checks` and `metadata` parameters. Any user that has access to UpTrain and a valid authentication method may be able to execute arbitrary code in the context of the host running UpTrain, which in most cases will be the docker container as suggested by the documentation. As of time of publication, no known patch is available.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/18/2026
The vulnerability identified within UpTrain versions 0.7.1 and prior represents a critical security flaw located specifically at the /add_prompts endpoint. This open-source platform, designed for evaluating and improving generative AI applications, suffers from an improper neutralization of special elements used in an OS command, commonly known as Command Injection or Remote Code Execution via unsanitized input parameters. The core technical failure lies in how the application processes data passed through the checks and metadata fields during prompt ingestion. Instead of strictly validating these inputs against a whitelist of expected formats or escaping dangerous characters, the backend logic directly incorporates them into system-level commands without adequate sanitization. This architectural oversight allows an attacker to inject malicious shell metacharacters that alter the intended command structure, thereby enabling arbitrary code execution on the host machine where UpTrain is deployed.
From an operational perspective, this vulnerability poses a severe risk because it grants any authenticated user with access to the platform the ability to execute commands in the context of the application's runtime environment. In typical deployment scenarios described by the documentation, UpTrain runs within a Docker container. Consequently, successful exploitation allows an attacker to achieve Remote Code Execution (RCE) inside that container. This level of compromise is particularly dangerous because it can serve as a pivot point for further attacks against the underlying host system or other containers in the same network segment if proper isolation measures are not enforced. The ability to execute arbitrary code means attackers could potentially exfiltrate sensitive data, modify application configurations, install backdoors, or disrupt service availability by consuming resources or killing processes within the containerized environment.
The classification of this vulnerability aligns with CWE-78 Improper Neutralization of Special Elements used in an OS Command and is closely related to CWE-94 Improper Control of Generation of Code (Code Injection). In terms of adversary behavior, this exploit maps directly to MITRE ATT&CK technique T1059 Command and Scripting Interpreter. Attackers can leverage standard shell commands such as bash or sh to execute payloads, potentially escalating privileges if the container runs with elevated permissions or has access to sensitive volumes mounted from the host system. The lack of input validation on both the checks and metadata parameters provides multiple vectors for exploitation, making it difficult for users to mitigate the issue simply by restricting which fields are editable without addressing the underlying code logic flaw.
As there is no known patch available at the time of publication, immediate mitigation strategies must focus on defensive controls rather than software updates. Organizations should implement strict network segmentation to isolate UpTrain instances from critical infrastructure and other sensitive services. Utilizing Web Application Firewalls (WAF) with rules designed to detect common command injection patterns can provide a layer of protection against automated exploitation attempts. Additionally, enforcing the principle of least privilege is crucial; ensuring that the Docker container runs as a non-root user significantly limits the potential impact of successful code execution by restricting access to host-level resources and system files. Regular auditing of application logs for unusual process creation or network connections originating from the UpTrain service can also aid in early detection of exploitation attempts while waiting for an official vendor patch.