49 matches found
aplusml (>=0.1.0, <=0.3.1), nbsv (0.1.6) +1 more potentially affected by CVE-2026-73415 via jupyterlab (3.5.2)
jupyterlab PYPI version 3.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on jupyterlab and may be impacted: - aplusml =0.1.0, =0.3.1 - nbsv 0.1.6 - uptrain 0.1.0.dev0 Source cves: CVE-2026-73415 Source advisory: OSV:PYSEC-2026-3671...
CVE-2025-27770
UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.7.1 and prior, the /createproject endpoint is vulnerable to remote code execution via the checks and metadata parameters. Any user that has access to UpTrain and a valid authentication method may b...
CVE-2025-27772
UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.7.1 and prior, the /newrun endpoint is vulnerable to remote code execution via the checks and metadata parameters. Any user that has access to UpTrain and a valid authentication method may be able ...
CVE-2025-27621
UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.7.1 and prior, the UpTrain backend creates a new default user with a static username, where the username is also used as the default API key. The UpTrain backend also has an open CORS policy. Using...
CVE-2025-27771
UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.7.1 and prior, the /addprompts endpoint is vulnerable to remote code execution via the checks and metadata parameters. Any user that has access to UpTrain and a valid authentication method may be...
CVE-2025-27772 Uptrain vulnerable to remote code execution via `/new_run` endpoint
UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.7.1 and prior, the /newrun endpoint is vulnerable to remote code execution via the checks and metadata parameters. Any user that has access to UpTrain and a valid authentication method may be able ...
CVE-2025-27772
UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.7.1 and prior, the "/newrun" endpoint is vulnerable to remote code execution via the "checks" and "metadata" parameters. Any user that has access to UpTrain and a valid authentication method may be...
CVE-2025-27772
UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.7.1 and prior, the /newrun endpoint is vulnerable to remote code execution via the checks and metadata parameters. Any user that has access to UpTrain and a valid authentication method may be able ...
CVE-2025-27772 Uptrain vulnerable to remote code execution via `/new_run` endpoint
UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.7.1 and prior, the /newrun endpoint is vulnerable to remote code execution via the checks and metadata parameters. Any user that has access to UpTrain and a valid authentication method may be able ...
EUVD-2025-210736
UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.7.1 and prior, the /newrun endpoint is vulnerable to remote code execution via the checks and metadata parameters. Any user that has access to UpTrain and a valid authentication method may be able ...
CVE-2025-27772
UpTrain versions 0.7.1 and earlier are vulnerable to remote code execution (CVSS 8.7 HIGH): the /new_run endpoint's checks and metadata parameters allow arbitrary code execution within the host container. A proof-of-concept exploit exists; no patch is currently available. Affected users should re...
CVE-2025-27771 Uptrain vulnerable to remote code execution via `/add_prompts` endpoint
UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.7.1 and prior, the /addprompts endpoint is vulnerable to remote code execution via the checks and metadata parameters. Any user that has access to UpTrain and a valid authentication method may be...
CVE-2025-27771 Uptrain vulnerable to remote code execution via `/add_prompts` endpoint
UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.7.1 and prior, the /addprompts endpoint is vulnerable to remote code execution via the checks and metadata parameters. Any user that has access to UpTrain and a valid authentication method may be...
CVE-2025-27771 Uptrain vulnerable to remote code execution via `/add_prompts` endpoint
UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.7.1 and prior, the /addprompts endpoint is vulnerable to remote code execution via the checks and metadata parameters. Any user that has access to UpTrain and a valid authentication method may be...
CVE-2025-27771
UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.7.1 and prior, the /addprompts endpoint is vulnerable to remote code execution via the checks and metadata parameters. Any user that has access to UpTrain and a valid authentication method may be...
CVE-2025-27771
UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.7.1 and prior, the "/addprompts" endpoint is vulnerable to remote code execution via the "checks" and "metadata" parameters. Any user that has access to UpTrain and a valid authentication method ma...
EUVD-2025-210735
UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.7.1 and prior, the /addprompts endpoint is vulnerable to remote code execution via the checks and metadata parameters. Any user that has access to UpTrain and a valid authentication method may be...
CVE-2025-27771
In UpTrain versions 0.7.1 and earlier, the /add_prompts endpoint accepts untrusted checks and metadata parameters that are deserialized and evaluated without sanitization, enabling arbitrary Python code execution. An authenticated user can achieve full host compromise (typically the Docker contai...
CVE-2025-27770 UpTrain vulnerable to Remote code execution at `/create_project`
UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.7.1 and prior, the /createproject endpoint is vulnerable to remote code execution via the checks and metadata parameters. Any user that has access to UpTrain and a valid authentication method may b...
EUVD-2025-210734
UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.7.1 and prior, the /createproject endpoint is vulnerable to remote code execution via the checks and metadata parameters. Any user that has access to UpTrain and a valid authentication method may b...