PyPi: Aim

CVE-2024-8238

Safety vulnerability ID: 76223

This vulnerability was reviewed by experts

The information on this page was manually curated by our Cybersecurity Intelligence Team.

Created at Mar 20, 2025 Updated at Apr 02, 2025
Scan your Python projects for vulnerabilities →

Advisory

In version 3.22.0 of aimhubio/aim, the AimQL query language uses an outdated version of the safergetattr() function from RestrictedPython. This version does not protect against the str.formatmap() method, allowing an attacker to leak server-side secrets or potentially gain unrestricted code execution. The vulnerability arises because str.formatmap() can read arbitrary attributes of Python objects, enabling attackers to access sensitive variables such as os.environ. If an attacker can write files to a known location on the Aim server, they can use str.formatmap() to load a malicious .dll/.so file into the Python interpreter, leading to unrestricted code execution.

Affected package

aim

Latest version: 4.0.3

A super-easy way to record, search and compare AI experiments.

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

Use this package?

Scan your Python project for dependency vulnerabilities in two minutes

Scan your application