CVE-2025-27770
Received Received - Intake

Remote Code Execution in UpTrain via API Parameters

Publication date: 2026-08-17

Last updated on: 2026-08-17

Assigner: GitHub, Inc.

Description
UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.7.1 and prior, the `/create_project` endpoint is vulnerable to remote code execution via the `checks` and `metadata` parameters. Any user that has access to UpTrain and a valid authentication method may be able to execute arbitrary code in the context of the host running UpTrain, which in most cases will be the docker container as suggested by the documentation. As of time of publication, no known patch is available.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-17
Last Modified
2026-08-17
Generated
2026-08-17
AI Q&A
2026-08-17
EPSS Evaluated
N/A
NVD
CVE-2025-27770
EUVD
EUVD-2025-210734

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
uptrain uptrain to 0.7.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-74 The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

UpTrain versions 0.7.1 and prior have a remote code execution vulnerability in the /create_project endpoint. Attackers with access and valid authentication can exploit the checks and metadata parameters to execute arbitrary code on the host system, typically within the UpTrain Docker container.

Detection Guidance

Check if your UpTrain instance is running version 0.7.1 or earlier. Inspect network traffic for requests to the /create_project endpoint with suspicious checks or metadata parameters. Look for unauthorized code execution attempts in logs, especially those involving eval() function calls.

Impact Analysis

If you use UpTrain 0.7.1 or earlier, an attacker with access could run malicious code on your system. This could lead to data breaches, system compromise, or unauthorized access to sensitive information stored in the UpTrain environment.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, which may violate GDPR, HIPAA, or other compliance requirements. Organizations using affected versions risk non-compliance due to potential exposure of personal or sensitive data.

Mitigation Strategies

Immediately restrict access to the /create_project endpoint to trusted users only. Disable or remove the vulnerable version (0.7.1 or prior) of UpTrain and isolate any running instances. Monitor network traffic for unusual activity related to this endpoint.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-27770. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart