CVE-2025-6193

{"id": "CVE-2025-6193", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "secalert@redhat.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 3.7, "exploitabilityScore": 1.7}]}, "published": "2025-06-20T16:15:29.713", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2025-6193", "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2374032", "source": "secalert@redhat.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Primary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "A command injection vulnerability was discovered in the TrustyAI Explainability toolkit. Arbitrary commands placed in certain fields of a LMEValJob custom resource (CR) may be executed in the LMEvalJob pod's terminal. This issue can be exploited via a maliciously crafted LMEvalJob by a user with permissions to deploy a CR."}, {"lang": "es", "value": "Se descubri\u00f3 una vulnerabilidad de inyecci\u00f3n de comandos en el kit de herramientas TrustyAI Explainability. Los comandos arbitrarios colocados en ciertos campos de un recurso personalizado (CR) de LMEValJob pueden ejecutarse en la terminal del pod de LMEvalJob. Este problema puede ser explotado mediante un LMEvalJob malintencionado por un usuario con permisos para implementar un CR."}], "lastModified": "2025-06-23T20:16:40.143", "sourceIdentifier": "secalert@redhat.com"}