Riskcovery

CVE-2025-6193

Trustyai-explainability: command injection via lmevaljob cr

State
Published
Severity
5.9 Medium
Published
Jun 20, 2025
Updated
Oct 9, 2026
Reserved
Jun 16, 2025

Read the record on cve.org

Description

A command injection vulnerability was discovered in the TrustyAI Explainability toolkit. Arbitrary commands placed in certain fields of a LMEValJob custom resource (CR) may be executed in the LMEvalJob pod's terminal. This issue can be exploited via a maliciously crafted LMEvalJob by a user with permissions to deploy a CR.

Scores

CVSSScoreVectorSource
3.15.9 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:Lredhat

Weaknesses

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Affected Products

ProductVersions
trustyAI
  • 1.38 and earlierAffected
Red Hat OpenShift AI 2.16Red Hat
  • 1774285579 and laterNot affected
Red Hat OpenShift AI (RHOAI)Red Hat
    Red Hat OpenShift AI (RHOAI)Red Hat
      Red Hat OpenShift AI (RHOAI)Red Hat
        Red Hat OpenShift AI (RHOAI)Red Hat
          Red Hat OpenShift AI (RHOAI)Red Hat

            References

            Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.