Command Injection Vulnerability in TrustyAI Explainability Toolkit by Red Hat
CVE-2025-6193

5.9MEDIUM

Key Information:

Vendor

Red Hat
Status
Red Hat Openshift Ai (rhoai)
Vendor
CVE Published:
20 June 2025

What is CVE-2025-6193?

A command injection vulnerability has been identified in the TrustyAI Explainability Toolkit, allowing arbitrary commands to be executed in the terminal of an LMEvalJob pod. This issue arises when users with sufficient permissions deploy a crafted LMEvalJob custom resource (CR), leading to the potential execution of unauthorized commands. Regular updates and assessments are crucial for safeguarding against this type of vulnerability.

References

https://access.redhat.com/security/cve/CVE-2025-6193
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2374032
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-6193 : Command Injection Vulnerability in TrustyAI Explainability Toolkit by Red Hat