Authenticated code execution via eval on form data

Code injection in the /create_project endpoint in UpTrain 0.7.1 and earlier allows remote authenticated users to execute arbitrary code. The handler in uptrain/dashboard/backend/app.py passes the untrusted checks[0] form field and metadata string directly to Python eval(), so attacker-supplied expressions run in the server process instead of being parsed as data. Exploitation requires access to a valid UpTrain authentication method, and successful execution runs with the privileges of the UpTrain host process, typically the self-hosted Docker container described by the project.