UpTrain: authenticated remote code execution via the checks and metadata parameters on /add_prompts

Impact

The /add_prompts endpoint passes the checks and metadata parameters into a path that executes them, giving any authenticated user arbitrary code execution in the process running UpTrain — the Docker container in the documented deployment. Evaluation credentials, prompt and dataset material, and outbound reach from that container all follow. This is a second endpoint with the same defect as CVE-2025-27770, so fixing access control on one route does not help; the exposure is the account boundary itself. No patch was available as of publication.

Who can reach it

Any authenticated UpTrain user with network reach to the dashboard backend. A standard account suffices — no admin role needed.

What to do

No fix is available as of publication for 0.7.1 and earlier. Mitigate by limiting network access to the dashboard, treating UpTrain accounts as code-execution-equivalent, and isolating the deployment from fleet credentials and shared storage. Retire the deployment if the evaluation workflow is no longer in use.

References

Related entries

• UpTrain: authenticated remote code execution via the checks and metadata parameters on /new_runCVE-2025-27772 · UpTrain dashboard backend (/new_run endpoint)High
• joblib: Arbitrary code execution via `eval` on the `pre_dispatch` flag in `Parallel()`CVE-2022-21797 · joblibHigh
• Gradio: Lack of path filteringCVE-2023-34239 · GradioHigh
• jupyter-lsp: Unauthenticated file read/write through the LSP extensionCVE-2024-22415 · jupyter-lspHigh
• SGLang (`/update_weights_from_tensor`): Unsafe deserialization of the `serialized_named_tensors` argumentCVE-2025-10164 · SGLang (`/update_weights_from_tensor`)High
• Jupyter Core (Windows): Config read from a shared writable pathCVE-2025-30167 · Jupyter Core (Windows)High