Safety vulnerability ID: 76202
The information on this page was manually curated by our Cybersecurity Intelligence Team.
A vulnerability in the LockManager.release_locks function in aimhubio/aim (commit bb76afe) allows for arbitrary file deletion through relative path traversal. The run_hash parameter, which is user-controllable, is concatenated without normalization as part of a path used to specify file deletion. This vulnerability is exposed through the Repo._close_run() method, which is accessible via the tracking server instruction API. As a result, an attacker can exploit this to delete any arbitrary file on the machine running the tracking server.
Latest version: 4.0.3
A super-easy way to record, search and compare AI experiments.
This vulnerability has no description
Scan your Python project for dependency vulnerabilities in two minutes
Scan your application