CVE-2025-27772 in UpTrain
Summary
by MITRE • 08/17/2026
UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.7.1 and prior, the `/new_run` endpoint is vulnerable to remote code execution via the `checks` and `metadata` parameters. Any user that has access to UpTrain and a valid authentication method may be able to execute arbitrary code in the context of the host running UpTrain, which in most cases will be the docker container as suggested by the documentation. As of time of publication, no known patch is available.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/17/2026
The vulnerability identified within UpTrain versions 0.7.1 and prior represents a critical security flaw located specifically at the /new_run endpoint. This open-source platform, designed for evaluating and improving generative AI applications, suffers from an improper neutralization of special elements used in an OS command context. The root cause lies in how the application processes input data passed through the checks and metadata parameters without adequate sanitization or validation. When a user submits requests containing these specific fields, the backend logic fails to properly escape or filter potentially malicious payloads before passing them to underlying system commands or interpreters. This lack of rigorous input handling allows an attacker to inject arbitrary operating system commands that are then executed with the privileges associated with the UpTrain service process.
From a technical perspective, this flaw is classified as CWE-78, which denotes Improper Neutralization of Special Elements used in an OS Command, commonly known as OS Command Injection. The vulnerability enables Remote Code Execution (RCE), allowing any authenticated user to gain control over the host environment running UpTrain. Given that documentation suggests the application typically runs within a Docker container, successful exploitation could lead not only to compromise of the immediate container but also potentially facilitate lateral movement if the container is misconfigured with excessive privileges or network access to other internal services. The presence of valid authentication does not mitigate this risk; rather, it defines the attack surface boundary, meaning any legitimate user account can be leveraged by an insider threat or a compromised credential holder to execute arbitrary code on the host system.
The operational impact of this vulnerability is severe due to its potential for full system compromise. An attacker who exploits this flaw can read sensitive data stored within the container, modify application configurations, install backdoors, or use the compromised instance as a pivot point to attack other resources in the network infrastructure. Since UpTrain handles evaluations and metadata related to generative AI models, there is also an indirect risk of model poisoning if the executed commands allow for file system modifications that affect training data or evaluation metrics. The absence of a known patch at the time of publication significantly heightens the urgency for immediate defensive measures, as automated exploitation tools targeting this specific endpoint are likely to emerge rapidly in public exploit databases.
To mitigate this vulnerability, organizations must implement strict input validation and output encoding practices within their deployment configurations until an official update is released by the UpTrain maintainers. It is recommended to restrict network access to the /new_run endpoint using firewall rules or reverse proxy configurations that limit exposure only to trusted IP addresses or internal networks where possible. Additionally, deploying Web Application Firewalls with specific rule sets capable of detecting OS command injection patterns can provide a layer of defense against exploitation attempts. Running the UpTrain service in a containerized environment with minimal privileges and disabling unnecessary shell access within the container further reduces the blast radius should an exploit succeed. Organizations should also monitor for unusual process executions or network connections originating from the host running UpTrain to detect potential compromise early.