Trustyai-explainability: command injection via lmevaljob cr
A command injection vulnerability was discovered in the TrustyAI Explainability toolkit. Arbitrary commands placed in certain fields of a LMEValJob custom resource (CR) may be executed in the LMEvalJob pod's terminal. This issue can be exploited via a maliciously crafted LMEvalJob by a user with permissions to deploy a CR.
Evidence and details
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2025-6193
Red Hat OpenShift AI 2.16
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Red Hat OpenShift AI (RHOAI)
Source reference: /containers/cna/affected/2/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Red Hat OpenShift AI (RHOAI)
Source reference: /containers/cna/affected/3/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Red Hat OpenShift AI (RHOAI)
Source reference: /containers/cna/affected/4/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Red Hat OpenShift AI (RHOAI)
Source reference: /containers/cna/affected/5/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Red Hat OpenShift AI (RHOAI)
Source reference: /containers/cna/affected/6/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
- Related CVEs
- CVE-2025-6193
Source reference:
/cveMetadata/cveId
Publisher severity
medium
Source reference: /containers/cna/metrics