---
id: CVE-2025-27770
title: >-
  UpTrain is an open-source platform to evaluate and improve generative AI
  applications
summary: >-
  UpTrain is an open-source platform to evaluate and improve generative AI
  applications. In version 0.7.1 and prior, the `/create_project` endpoint is
  vulnerable to remote code execution via the `checks` and `metadata`
  parameters. Any user…
severity: none
cwe:
  - CWE-74
published: '2026-08-17'
updated: '2026-09-18'
sourceUpdated: '2026-09-18T20:09:01.757'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-27770'
references:
  - url: >-
      https://github.com/uptrain-ai/uptrain/blob/a31cc14eddcb6c0b0b12cbed15f086d98c441c6f/uptrain/dashboard/backend/app.py#L691C22-L691C36
    label: security-advisories@github.com
  - url: >-
      https://securitylab.github.com/advisories/GHSL-2024-198_GHSL-2024-199_Uptrain/
    label: security-advisories@github.com
tags:
  - nvd
epss: 0.0061
epssPercentile: 0.47574
ingestedAt: '2026-09-18T20:51:25.619Z'
---

## Overview

UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.7.1 and prior, the `/create_project` endpoint is vulnerable to remote code execution via the `checks` and `metadata` parameters. Any user that has access to UpTrain and a valid authentication method may be able to execute arbitrary code in the context of the host running UpTrain, which in most cases will be the docker container as suggested by the documentation. As of time of publication, no known patch is available.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.