TrustyAI Explainability Toolkit Command Injection Vulnerability in LMEvalJob Custom Resource

A command injection vulnerability exists in the TrustyAI Explainability toolkit. This issue allows arbitrary commands to be executed in the terminal of the LMEvalJob pod. The vulnerability arises when a user with permission to deploy a LMEvalJob custom resource (CR) crafts a maliciously designed CR, exploiting certain fields that can escape the intended command execution context.

Impact

Exploitation of this vulnerability allows for command injection, where arbitrary commands can be executed in the context of the LMEvalJob pod.