CVE-2025-27772 uptrain-ai CVE debrief

Who should care

Defenders responsible for UpTrain instances, particularly those exposed to the internet or used in sensitive applications, should assess exposure and prioritize mitigation. This includes operators, platform administrators, and security teams who manage UpTrain deployments. They should verify UpTrain version and exposure to the internet, and consider compensating controls to prevent potential arbitrary code execution and lateral movement. Defenders should

Why it matters

CVE-2025-27772 is a high-severity vulnerability in UpTrain that allows for remote code execution. Defenders should assess exposure, prioritize mitigation, and consider compensating controls to prevent potential arbitrary code execution and lateral movement.

• Potential for arbitrary code execution in the context of the host running UpTrain
• Possible lateral movement within the network if not properly isolated
• Need for verification of UpTrain version and exposure to the internet
• Potential for data tampering or unauthorized access to sensitive information

Technical summary

The `/new_run` endpoint in UpTrain version 0.7.1 and prior is vulnerable to remote code execution via the `checks` and `metadata` parameters. This allows users with access to UpTrain and a valid authentication method to execute arbitrary code in the context of the host running UpTrain. The vulnerability has a high severity score and requires immediate attention from defenders. UpTrain instances exposed to the internet or used in sensitive applications should be prioritized for mitigation. The CVE record and NVD entry provide details

Defensive priority

High priority for systems using UpTrain version 0.7.1 or prior

Recommended defensive actions

• Assess exposure of UpTrain instances to the internet
• Verify authentication methods in use for UpTrain
• Monitor `/new_run` endpoint for suspicious activity
• Consider compensating controls, such as restricting access to the endpoint
• Review vendor guidance for UpTrain
• Perform asset inventory of UpTrain instances
• Track exceptions and retest remediated assets

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description and affected versions. However, no known patch is available at the time of publication. Defenders should verify UpTrain version and exposure to the internet. The vulnerability affects UpTrain version 0.7.1 and prior, allowing for remote code execution via the `/new_run` endpoint. Users with access to UpTrain and a valid authentication method may be able to execute arbitrary code in the context of the host running UpTrain. Evidence from the CVE

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.