Safety vulnerability ID: 76223
The information on this page was manually curated by our Cybersecurity Intelligence Team.
In version 3.22.0 of aimhubio/aim, the AimQL query language uses an outdated version of the safergetattr() function from RestrictedPython. This version does not protect against the str.formatmap() method, allowing an attacker to leak server-side secrets or potentially gain unrestricted code execution. The vulnerability arises because str.formatmap() can read arbitrary attributes of Python objects, enabling attackers to access sensitive variables such as os.environ. If an attacker can write files to a known location on the Aim server, they can use str.formatmap() to load a malicious .dll/.so file into the Python interpreter, leading to unrestricted code execution.
Latest version: 4.0.3
A super-easy way to record, search and compare AI experiments.
This vulnerability has no description
Scan your Python project for dependency vulnerabilities in two minutes
Scan your application