CVE-2025-27770 UpTrain vulnerable to Remote code execution at `/create_project`

UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.7.1 and prior, the /createproject endpoint is vulnerable to remote code execution via the checks and metadata parameters. Any user that has access to UpTrain and a valid authentication method may b...

CVE-2025-27621

UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.7.1 and prior, the UpTrain backend creates a new default user with a static username, where the username is also used as the default API key. The UpTrain backend also has an open CORS policy. Using...

CVE-2025-27621 UpTrain has a Constant Default API Key

UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.7.1 and prior, the UpTrain backend creates a new default user with a static username, where the username is also used as the default API key. The UpTrain backend also has an open CORS policy. Using...

CVE-2025-27621 UpTrain has a Constant Default API Key

UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.7.1 and prior, the UpTrain backend creates a new default user with a static username, where the username is also used as the default API key. The UpTrain backend also has an open CORS policy. Using...

CVE-2025-27621 UpTrain has a Constant Default API Key

UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.7.1 and prior, the UpTrain backend creates a new default user with a static username, where the username is also used as the default API key. The UpTrain backend also has an open CORS policy. Using...

EUVD-2025-210733

UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.7.1 and prior, the UpTrain backend creates a new default user with a static username, where the username is also used as the default API key. The UpTrain backend also has an open CORS policy. Using...

CVE-2025-27621

UpTrain ≤0.7.1 ships a static default API key derived from a hardcoded username and an open CORS policy, letting any website send authenticated cross-origin requests via the uptrain-access-token header and perform privileged actions. CVSS 8.7 HIGH. No patch is available; monitor the GitHub adviso...

PT-2026-76677

Name of the Vulnerable Software and Affected Versions UpTrain versions prior to 0.7.1 Description The backend creates a default user with a static username that also serves as the default API key. Combined with an open Cross-Origin Resource Sharing CORS policy—a mechanism that allows restricted...

CVE-2025-27770: Improper Neutralization of Special Elements in Output Used by a Downstream Component

UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.7.1 and prior, the /createproject endpoint is vulnerable to remote code execution via the checks and metadata parameters. Any user that has access to UpTrain and a valid authentication method may b...

CVE-2025-27771: Improper Neutralization of Special Elements in Output Used by a Downstream Component

UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.7.1 and prior, the /addprompts endpoint is vulnerable to remote code execution via the checks and metadata parameters. Any user that has access to UpTrain and a valid authentication method may be...

PT-2026-76687

Name of the Vulnerable Software and Affected Versions UpTrain versions prior to 0.7.2 Description An issue exists in the /new run endpoint that allows remote code execution. Authenticated users can execute arbitrary code on the host system, typically within the Docker container, by manipulating t...

PT-2026-76678

Name of the Vulnerable Software and Affected Versions UpTrain versions prior to 0.7.2 Description UpTrain is an open-source platform used to evaluate and improve generative AI applications. The /create project endpoint allows authenticated users to execute arbitrary code on the host system,...

PT-2026-76679

Name of the Vulnerable Software and Affected Versions UpTrain versions prior to 0.7.2 Description UpTrain is an open-source platform used to evaluate and improve generative AI applications. The '/add prompts' endpoint is susceptible to remote code execution, allowing authenticated users to execut...

CVE-2025-27621: Improper Authentication

UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.7.1 and prior, the UpTrain backend creates a new default user with a static username, where the username is also used as the default API key. The UpTrain backend also has an open CORS policy. Using...

CVE-2025-27772: Improper Neutralization of Special Elements in Output Used by a Downstream Component

UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.7.1 and prior, the /newrun endpoint is vulnerable to remote code execution via the checks and metadata parameters. Any user that has access to UpTrain and a valid authentication method may be able ...

aplusml (>=0.1.0, <=0.3.1), nbsv (0.1.6) +1 more potentially affected by CVE-2026-73415 via jupyterlab (3.5.2)

jupyterlab PYPI version 3.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on jupyterlab and may be impacted: - aplusml =0.1.0, =0.3.1 - nbsv 0.1.6 - uptrain 0.1.0.dev0 Source cves: CVE-2026-73415 Source advisory: OSV:GHSA-GX64-GJ6P-PC4C...

aplusml (>=0.1.0, <=0.3.1), nbsv (0.1.6) +1 more potentially affected by CVE-2026-73626 via jupyterlab (3.5.2)

jupyterlab PYPI version 3.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on jupyterlab and may be impacted: - aplusml =0.1.0, =0.3.1 - nbsv 0.1.6 - uptrain 0.1.0.dev0 Source cves: CVE-2026-73626 Source advisory: OSV:GHSA-WHVH-WF3X-G77J...

aplusml (>=0.1.0, <=0.3.1), nbsv (0.1.6) +1 more potentially affected by CVE-2026-40171 via jupyterlab (3.5.2)

jupyterlab PYPI version 3.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on jupyterlab and may be impacted: - aplusml =0.1.0, =0.3.1 - nbsv 0.1.6 - uptrain 0.1.0.dev0 Source cves: CVE-2026-40171 Source advisory: OSV:PYSEC-2026-2538...

aplusml (>=0.1.0, <=0.3.1), nbsv (0.1.6) +1 more potentially affected by CVE-2026-42557 via jupyterlab (3.5.2)

jupyterlab PYPI version 3.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on jupyterlab and may be impacted: - aplusml =0.1.0, =0.3.1 - nbsv 0.1.6 - uptrain 0.1.0.dev0 Source cves: CVE-2026-42557 Source advisory: OSV:GHSA-MQCG-5X36-VFCG...

aplusml (>=0.1.0, <=0.3.1), nbsv (0.1.6) +1 more potentially affected by CVE-2026-40171 via jupyterlab (3.5.2)

jupyterlab PYPI version 3.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on jupyterlab and may be impacted: - aplusml =0.1.0, =0.3.1 - nbsv 0.1.6 - uptrain 0.1.0.dev0 Source cves: CVE-2026-40171 Source advisory: OSV:GHSA-RCH3-82JR-F9W9...