{"schema":"threatline.record/2","record":{"id":"CVE-2024-2195","aliases":["GHSA-mxvw-cj37-8g2h","PYSEC-2026-260"],"summary":"Aim Web API vulnerable to Remote Code Execution","details":"A critical Remote Code Execution (RCE) vulnerability was identified in the aimhubio/aim project, specifically within the `/api/runs/search/run/` endpoint, affecting versions >= 3.0.0. The vulnerability resides in the `run_search_api` function of the `aim/web/api/runs/views.py` file, where improper restriction of user access to the `RunView` object allows for the execution of arbitrary code via the `query` parameter. This issue enables attackers to execute arbitrary commands on the server, potentially leading to full system compromise.","categories":["Libraries & packages"],"product":"aim","vendor":"aimhubio","ecosystem":"pip","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-mxvw-cj37-8g2h","source_modified_at":"2026-10-27T15:11:21Z","fetched_at":"2026-10-27T16:27:21.584480Z","package":{"ecosystem":"pip","name":"aim"},"range":">= 3.0.0, <= 3.25.0"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-2195","source_modified_at":"2024-08-01T19:03:39.092Z","fetched_at":"2026-10-27T16:27:21.584480Z","product":"aimhubio/aim","vendor":"aimhubio","versions":[{"version":"unspecified","status":"affected","versionType":"custom","lessThanOrEqual":"latest"}],"defaultStatus":null},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-mxvw-cj37-8g2h","source_modified_at":"2026-10-27T15:30:04.343940178Z","fetched_at":"2026-10-27T16:27:21.584480Z","package":{"name":"aim","ecosystem":"PyPI","purl":"pkg:pypi/aim"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"last_affected":"3.25.0"}]}],"versions":["3.0.0","3.0.1","3.0.2","3.0.3","3.0.4","3.0.5","3.0.6","3.0.7","3.1.0","3.1.1","3.10.0","3.10.0.dev9","3.10.1","3.10.2","3.10.3","3.11.0","3.11.0.dev4","3.11.1","3.11.1.dev1","3.11.2","3.12.0","3.12.0.dev2","3.12.1","3.12.2","3.13.0","3.13.1","3.13.2","3.13.3","3.13.4","3.14.0","3.14.1","3.14.2","3.14.3","3.14.4","3.15.0","3.15.1","3.15.2","3.16.0","3.16.1","3.16.2","3.17.0","3.17.1","3.17.2","3.17.3","3.17.4","3.17.5","3.17.5rc1","3.17.5rc2","3.17.5rc3","3.17.5rc4"]}],"fixed_versions":[],"cvss":9.8,"severity":"Critical","kev":{"listed":false},"epss":{"probability":0.01815,"percentile":0.78567,"score_date":"2026-10-27"},"published_at":"2024-04-10T17:08:12.635Z","modified_at":"2026-10-27T15:30:04.343940178Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-mxvw-cj37-8g2h","fetched_at":"2026-10-27T16:27:21.584480Z","source_modified_at":"2026-10-27T15:11:21Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2024-2195","fetched_at":"2026-10-27T16:27:21.584480Z","source_modified_at":"2024-08-01T19:03:39.092Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-mxvw-cj37-8g2h","fetched_at":"2026-10-27T16:27:21.584480Z","source_modified_at":"2026-10-27T15:30:04.343940178Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-2195","fetched_at":"2026-10-27T16:27:21.584480Z","source_modified_at":"2026-10-27"}],"sources":["GitHub Advisory Database","CVE List","OSV","EPSS"],"references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-2195","source":"GitHub Advisory Database"},{"source":"CVE List","url":"https://huntr.com/bounties/22f2355e-b875-4c01-b454-327e5951c018","tags":["x_transferred"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/aim/PYSEC-2026-260.yaml","source":"GitHub Advisory Database"},{"url":"https://pypi.org/project/aim","source":"GitHub Advisory Database"},{"url":"https://github.com/advisories/GHSA-mxvw-cj37-8g2h","source":"GitHub Advisory Database"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","ssvc":{"exploitation":"poc","automatable":"yes","technical_impact":"total","assessed_at":"2024-04-10T19:27:31.546352Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-27T15:30:04.343940178Z","content_hash":"aa1cc8c08ff7ff178aa83b8a7066bf4525c41d1dd81a983fc2c6401abebe9af3"}}