All vulnerabilities
CVE-2024-2195GHSA-mxvw-cj37-8g2hPYSEC-2026-260

Aim Web API vulnerable to Remote Code Execution

aimhubio aimpipLibraries & packages
Open in ThreatlineRecord JSON
CVSS
9.8Critical
ExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 10 Apr 2024. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)1.81%Chance of exploitation activity in the next 30 days, higher than 78% of CVEs. Scored 27 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
Published10 Apr 2024Updated 27 Oct 2026CVE List

What fixes it

No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.

Description

A critical Remote Code Execution (RCE) vulnerability was identified in the aimhubio/aim project, specifically within the /api/runs/search/run/ endpoint, affecting versions >= 3.0.0. The vulnerability resides in the run_search_api function of the aim/web/api/runs/views.py file, where improper restriction of user access to the RunView object allows for the execution of arbitrary code via the query parameter. This issue enables attackers to execute arbitrary commands on the server, potentially leading to full system compromise.

Text from CVE List

Affected versions 53

  • aim, pip>= 3.0.0, <= 3.25.0GitHub
  • aimhubio/aimaffected: unspecified through latestCVE List
  • aim, PyPIfrom 3.0.0, through 3.25.0OSV
  • aim, PyPI3.0.0OSV
  • aim, PyPI3.0.1OSV
  • aim, PyPI3.0.2OSV
  • aim, PyPI3.0.3OSV
  • aim, PyPI3.0.4OSV
  • aim, PyPI3.0.5OSV
  • aim, PyPI3.0.6OSV
  • aim, PyPI3.0.7OSV
  • aim, PyPI3.1.0OSV
  • aim, PyPI3.1.1OSV
  • aim, PyPI3.10.0OSV
  • aim, PyPI3.10.0.dev9OSV
  • aim, PyPI3.10.1OSV
  • aim, PyPI3.10.2OSV
  • aim, PyPI3.10.3OSV
  • aim, PyPI3.11.0OSV
  • aim, PyPI3.11.0.dev4OSV
  • aim, PyPI3.11.1OSV
  • aim, PyPI3.11.1.dev1OSV
  • aim, PyPI3.11.2OSV
  • aim, PyPI3.12.0OSV
  • aim, PyPI3.12.0.dev2OSV
  • aim, PyPI3.12.1OSV
  • aim, PyPI3.12.2OSV
  • aim, PyPI3.13.0OSV
  • aim, PyPI3.13.1OSV
  • aim, PyPI3.13.2OSV
  • aim, PyPI3.13.3OSV
  • aim, PyPI3.13.4OSV
  • aim, PyPI3.14.0OSV
  • aim, PyPI3.14.1OSV
  • aim, PyPI3.14.2OSV
  • aim, PyPI3.14.3OSV
  • aim, PyPI3.14.4OSV
  • aim, PyPI3.15.0OSV
  • aim, PyPI3.15.1OSV
  • aim, PyPI3.15.2OSV
  • aim, PyPI3.16.0OSV
  • aim, PyPI3.16.1OSV
  • aim, PyPI3.16.2OSV
  • aim, PyPI3.17.0OSV
  • aim, PyPI3.17.1OSV
  • aim, PyPI3.17.2OSV
  • aim, PyPI3.17.3OSV
  • aim, PyPI3.17.4OSV
  • aim, PyPI3.17.5OSV
  • aim, PyPI3.17.5rc1OSV
  • aim, PyPI3.17.5rc2OSV
  • aim, PyPI3.17.5rc3OSV
  • aim, PyPI3.17.5rc4OSV

References 5