critical9.8
CVE-2024-2195
A critical Remote Code Execution (RCE) vulnerability was identified in the aimhubio/aim project, specifically within the `/api/runs/search/run/` endpoint, affe…
Impact
A critical Remote Code Execution (RCE) vulnerability was identified in the aimhubio/aim project, specifically within the `/api/runs/search/run/` endpoint, affecting versions >= 3.0.0. The vulnerability resides in the `run_search_api` function of the `aim/web/api/runs/views.py` file, where improper restriction of user access to the `RunView` object allows for the execution of arbitrary code via the `query` parameter. This issue enables attackers to execute arbitrary commands on the server, potentially leading to full system compromise.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | aim | >= 3.0.0, <= 3.25.0 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Aimstack | Aim | from 3.0.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-mxvw-cj37-8g2h
- https://nvd.nist.gov/vuln/detail/CVE-2024-2195
- https://huntr.com/bounties/22f2355e-b875-4c01-b454-327e5951c018
- https://github.com/pypa/advisory-database/tree/main/vulns/aim/PYSEC-2026-260.yaml
- https://pypi.org/project/aim