CVE-2025-6193: medium-severity vulnerability in trustyAI
Trustyai-explainability: command injection via lmevaljob cr
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.9epss 0.7%
A command injection vulnerability was discovered in the TrustyAI Explainability toolkit. Arbitrary commands placed in certain fields of a LMEValJob custom resource (CR) may be executed in the LMEvalJob pod's terminal. This issue can be exploited via a maliciously crafted LMEvalJob by a user with permissions to deploy a CR.
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
Related CVEs — trustyAI
In the same product, most dangerous first.
CVE-2026-23536HIGHFeast: unauthenticated arbitrary file readEPSS 2.5%CVE-2024-11831MEDIUMNpm-serialize-javascript: cross-site scripting (xss) in serialize-javascriptEPSS 1.1%CVE-2026-18948CRITICALFeast: feast: unsafe dill deserialization of registry-stored udfs — rce on feature server and registry serverEPSS 1.1%CVE-2026-23537CRITICALFeast: unauthenticated arbitrary file writeEPSS 1.0%CVE-2026-0603HIGHOrg.hibernate/hibernate-core: hibernate: information disclosure and data deletion via second-order sql injectionEPSS 1.0%CVE-2026-0990MEDIUMLibxml2: libxml2: denial of service via uncontrolled recursion in xml catalog processingEPSS 1.0%