THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2025-27772 — UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.7.1 and prior, the `/new_run` endpoint is vulnerable to remote code execution via the `checks` and `metadata` parameters. Any user that has access to UpTrain and a valid authentica

[NVD] CVE-2025-27772 — UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.7.1 and prior, the `/new_run` endpoint is vulnerable to remote code execution via the `checks` and `metadata` parameters. Any user that has access to UpTrain and a valid authentica

lownvdPublished 2026-08-17

CVE-2025-27772 CVSS: None Published: 2026-08-17T16:16:46.710

UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.7.1 and prior, the `/new_run` endpoint is vulnerable to remote code execution via the `checks` and `metadata` parameters. Any user that has access to UpTrain and a valid authentication method may be able to execute arbitrary code in the

MITRE ATT&CK techniques

Generative AIAML.T0016.002

Indicators of compromise

CVE-2025-27772cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2025-27772