aim vulnerabilities and fixes

Recent CVEs affecting aim, with upgrade or downgrade steps. 17 tracked.

aim has 17 tracked vulnerabilities, 3 critical. A fixed release or vendor patch exists for 3. Most recent: 2025-07-22. Highest priority: CVE-2024-8769 (score 57/100).

• CVE-2025-5321 MEDIUM 6.3 UPGRADE A vulnerability classified as critical was found in aimhubio aim up to 3.29.1
• CVE-2025-51464 HIGH 8.8 DOWNGRADE Cross-site Scripting (XSS) in aimhubio Aim 3.28.0 allows remote attackers to execute arbitrary JavaScript in v
• CVE-2025-51463 HIGH 7.0 DOWNGRADE Path Traversal in restore_run_backup() in AIM 3.28.0 allows remote attackers to write arbitrary files to the s
• CVE-2025-0190 HIGH 7.5 DOWNGRADE In version 3.25.0 of aimhubio/aim, a denial of service vulnerability exists
• CVE-2025-0189 HIGH 7.5 DOWNGRADE In version 3.25.0 of aimhubio/aim, the tracking server is vulnerable to a denial of service attack
• CVE-2024-8863 LOW 3.5 UPGRADE A vulnerability, which was classified as problematic, was found in aimhubio aim up to 3.24
• CVE-2024-8769 CRITICAL 9.1 UPGRADE A vulnerability in the `LockManager.release_locks` function in aimhubio/aim (commit bb76afe) allows for arbitr
• CVE-2024-8238 HIGH 8.1 DOWNGRADE In version 3.22.0 of aimhubio/aim, the AimQL query language uses an outdated version of the safer_getattr() fu
• CVE-2024-8101 MEDIUM 6.1 DOWNGRADE A stored cross-site scripting (XSS) vulnerability exists in the Text Explorer component of aimhubio/aim versio
• CVE-2024-8061 HIGH 7.5 DOWNGRADE In version 3.23.0 of aimhubio/aim, certain methods that request data from external servers do not have set tim
• CVE-2024-7760 CRITICAL 9.6 DOWNGRADE aimhubio/aim version 3.22.0 contains a Cross-Site Request Forgery (CSRF) vulnerability in the tracking server
• CVE-2024-6851 HIGH 7.5 DOWNGRADE In version 3.22.0 of aimhubio/aim, the LocalFileManager._cleanup function in the aim tracking server accepts a
• CVE-2024-6829 CRITICAL 9.1 DOWNGRADE A vulnerability in aimhubio/aim version 3.19.3 allows an attacker to exploit the `tarfile.extractall()` functi
• CVE-2024-6483 MEDIUM 5.3 DOWNGRADE A vulnerability in the `runs/delete-batch` endpoint of aimhubio/aim version 3.19.3 allows for arbitrary file o
• CVE-2024-12778 HIGH 7.5 DOWNGRADE A vulnerability in aimhubio/aim version 3.25.0 allows for a denial of service (DoS) attack
• CVE-2024-12777 MEDIUM 5.9 DOWNGRADE A vulnerability in aimhubio/aim version 3.25.0 allows for a denial of service through the misuse of the sshfs-
• CVE-2024-10110 HIGH 7.5 DOWNGRADE In version 3.23.0 of aimhubio/aim, the ScheduledStatusReporter object can be instantiated to run on the main t

FAQ

How do I fix aim vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is aim being exploited right now?

None of the tracked aim CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which aim CVE should I patch first?

CVE-2024-8769 currently ranks highest (57/100): A vulnerability in the `LockManager.release_locks` function in aimhubio/aim (commit bb76afe) allows for arbitr.

RSS feed for aim · ← Back to latest CVEs