What is the CVSS score of CVE-2025-6193?

CVE-2025-6193 has a CVSS 3.1 base score of 5.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.1%.

Which versions of Red Hat are affected by CVE-2025-6193?

Organizations using A command injection vulnerability should be aware of moderate risk from CVE-2025-6193, a OS command injection vulnerability rated CVSS 5.9.. A patch is available.

How to fix or mitigate CVE-2025-6193?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Validate input sanitization for user-controlled parameters.

Red Hat CVE-2025-6193

EUVD-2025-18760 MEDIUM

OS Command Injection (CWE-78)

2025-06-20 secalert@redhat.com

Command Injection Red Hat

5.9

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.9 MEDIUM

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L

Red Hat

5.9 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Patch released

Apr 07, 2026 - 08:30 nvd

Patch available

EUVD ID Assigned

Mar 15, 2026 - 00:19 euvd

EUVD-2025-18760

Analysis Generated

Mar 15, 2026 - 00:19 vuln.today

CVE Published

Jun 20, 2025 - 16:15 nvd

MEDIUM 5.9

DescriptionCVE.org

A command injection vulnerability was discovered in the TrustyAI Explainability toolkit. Arbitrary commands placed in certain fields of a LMEValJob custom resource (CR) may be executed in the LMEvalJob pod's terminal. This issue can be exploited via a maliciously crafted LMEvalJob by a user with permissions to deploy a CR.

AnalysisAI

A command injection vulnerability was discovered in the TrustyAI Explainability toolkit.

Technical ContextAI

Command injection allows an attacker to execute arbitrary OS commands on the host system through a vulnerable application that passes user input to system shells. This vulnerability is classified as OS Command Injection (CWE-78).

RemediationAI

Avoid passing user input to system commands. Use language-specific APIs instead of shell commands. If unavoidable, use strict input validation and escaping.