Authenticated code execution via eval on form data

Code execution in UpTrain 0.7.1 and earlier allows remote authenticated users to run Python code via crafted checks and metadata form fields in /new_run. The dashboard backend's new_run handler passes attacker-controlled checks[0] and metadata strings directly to Python eval(), so submitted form data is executed instead of parsed. Reachability requires access to an UpTrain authentication method, and execution occurs in the server process context, typically the documented Docker container.