AimStack Aim

aimhubio aim run_view Object query.py RestrictedPythonQuery privilege escalation

Arbitrary File Overwrite and Data Exfiltration in aimhubio/aim

Remote Code Execution in aimhubio/aim

CSRF in aimhubio/aim

Arbitrary File Deletion via Relative Path Traversal in aimhubio/aim

Arbitrary File Overwrite through tarfile-extraction in aimhubio/aim

Cross-site Scripting (XSS) in aimhubio Aim 3.28.0 allows remote attackers to execute arbitrary JavaScript in victims browsers via malicious Python code submitted to the /api/reports endpoint, which is interpreted and executed by Pyodide when the report is viewed. No sanitisation or sandbox restrictions prevent JavaScript execution via pyodide.code.run_js().

CSRF Vulnerability in aimhubio/aim

Arbitrary file reading vulnerability in Aim

Unrestricted Code Execution in aimhubio/aim

Arbitrary File Deletion in aimhubio/aim

Denial of Service in aimhubio/aim

Denial of Service in aimhubio/aim

Denial of Service in aimhubio/aim

Denial of Service in aimhubio/aim

Infinite Loop in aimhubio/aim

Denial of Service in aimhubio/aim

Stored XSS in aimhubio/aim

Stored XSS in aimhubio/aim

Path Traversal in restore_run_backup() in AIM 3.28.0 allows remote attackers to write arbitrary files to the server's filesystem via a crafted backup tar file submitted to the run_instruction API, which is extracted without path validation during restoration.

Denial of Service in aimhubio/aim

aimhubio aim Text Explorer textbox.tsx dangerouslySetInnerHTML cross site scripting

Arbitrary File/Directory Deletion in aimhubio/aim