CVE-2025-6193: falha de média gravidade em trustyAI
Trustyai-explainability: command injection via lmevaljob cr
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.9epss 0.7%
A command injection vulnerability was discovered in the TrustyAI Explainability toolkit. Arbitrary commands placed in certain fields of a LMEValJob custom resource (CR) may be executed in the LMEvalJob pod's terminal. This issue can be exploited via a maliciously crafted LMEvalJob by a user with permissions to deploy a CR.
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
CVEs relacionadas — trustyAI
No mesmo produto, das mais perigosas para as menos.
CVE-2026-23536HIGHFeast: unauthenticated arbitrary file readEPSS 2.5%CVE-2024-11831MEDIUMNpm-serialize-javascript: cross-site scripting (xss) in serialize-javascriptEPSS 1.1%CVE-2026-18948CRITICALFeast: feast: unsafe dill deserialization of registry-stored udfs — rce on feature server and registry serverEPSS 1.1%CVE-2026-23537CRITICALFeast: unauthenticated arbitrary file writeEPSS 1.0%CVE-2026-0603HIGHOrg.hibernate/hibernate-core: hibernate: information disclosure and data deletion via second-order sql injectionEPSS 1.0%CVE-2026-0990MEDIUMLibxml2: libxml2: denial of service via uncontrolled recursion in xml catalog processingEPSS 1.0%