https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-51464.htmlhttps://patchthecve.com/cve/CVE-2025-51464.htmlWed, 17 Jun 2026 09:35:36 +0000HIGH 8.8: Cross-site Scripting (XSS) in aimhubio Aim 3.28.0 allows remote attackers to execute arbitrary JavaScript in victims browsers via malicious Python code submitted to the /api/reports endpoint, which is interpreted and executed by Pyodide when the report is viewed. No sanitisation or sandbox restrictihttps://patchthecve.com/cve/CVE-2025-51463.htmlhttps://patchthecve.com/cve/CVE-2025-51463.htmlWed, 17 Jun 2026 09:35:36 +0000HIGH 7.0: Path Traversal in restore_run_backup() in AIM 3.28.0 allows remote attackers to write arbitrary files to the server's filesystem via a crafted backup tar file submitted to the run_instruction API, which is extracted without path validation during restoration.https://patchthecve.com/cve/CVE-2025-5321.htmlhttps://patchthecve.com/cve/CVE-2025-5321.htmlWed, 17 Jun 2026 09:47:40 +0000MEDIUM 6.3: A vulnerability classified as critical was found in aimhubio aim up to 3.29.1. This vulnerability affects the function RestrictedPythonQuery of the file /aim/storage/query.py of the component run_view Object Handler. The manipulation of the argument Abfrage leads to erweiterte Rechte. The attack canhttps://patchthecve.com/cve/CVE-2025-0190.htmlhttps://patchthecve.com/cve/CVE-2025-0190.htmlWed, 17 Jun 2026 08:26:02 +0000HIGH 7.5: In version 3.25.0 of aimhubio/aim, a denial of service vulnerability exists. By tracking a large number of `Text` objects and then querying them simultaneously through the web API, the Aim web server becomes unresponsive to other requests for an extended period while processing and returning these ohttps://patchthecve.com/cve/CVE-2025-0189.htmlhttps://patchthecve.com/cve/CVE-2025-0189.htmlWed, 17 Jun 2026 08:26:02 +0000HIGH 7.5: In version 3.25.0 of aimhubio/aim, the tracking server is vulnerable to a denial of service attack. The server overrides the maximum size for websocket messages, allowing very large images to be tracked. This causes the server to become unresponsive to other requests while processing the large imagehttps://patchthecve.com/cve/CVE-2024-8769.htmlhttps://patchthecve.com/cve/CVE-2024-8769.htmlWed, 17 Jun 2026 08:23:16 +0000CRITICAL 9.1: A vulnerability in the `LockManager.release_locks` function in aimhubio/aim (commit bb76afe) allows for arbitrary file deletion through relative path traversal. The `run_hash` parameter, which is user-controllable, is concatenated without normalization as part of a path used to specify file deletionhttps://patchthecve.com/cve/CVE-2024-8238.htmlhttps://patchthecve.com/cve/CVE-2024-8238.htmlWed, 17 Jun 2026 08:22:10 +0000HIGH 8.1: In version 3.22.0 of aimhubio/aim, the AimQL query language uses an outdated version of the safer_getattr() function from RestrictedPython. This version does not protect against the str.format_map() method, allowing an attacker to leak server-side secrets or potentially gain unrestricted code executhttps://patchthecve.com/cve/CVE-2024-8101.htmlhttps://patchthecve.com/cve/CVE-2024-8101.htmlWed, 17 Jun 2026 08:21:52 +0000MEDIUM 6.1: A stored cross-site scripting (XSS) vulnerability exists in the Text Explorer component of aimhubio/aim version 3.23.0. The vulnerability arises due to the use of `dangerouslySetInnerHTML` without proper sanitization, allowing arbitrary JavaScript execution when rendering tracked texts. This can be https://patchthecve.com/cve/CVE-2024-8061.htmlhttps://patchthecve.com/cve/CVE-2024-8061.htmlWed, 17 Jun 2026 08:21:47 +0000HIGH 7.5: In version 3.23.0 of aimhubio/aim, certain methods that request data from external servers do not have set timeouts, causing the server to wait indefinitely for a response. This can lead to a denial of service, as the tracking server does not respond to other requests while waiting. The issue ariseshttps://patchthecve.com/cve/CVE-2024-7760.htmlhttps://patchthecve.com/cve/CVE-2024-7760.htmlWed, 17 Jun 2026 08:20:52 +0000CRITICAL 9.6: aimhubio/aim version 3.22.0 contains a Cross-Site Request Forgery (CSRF) vulnerability in the tracking server. The vulnerability is due to overly permissive CORS settings, allowing cross-origin requests from all origins. This enables CSRF attacks on all endpoints of the tracking server, which can behttps://patchthecve.com/cve/CVE-2024-6851.htmlhttps://patchthecve.com/cve/CVE-2024-6851.htmlWed, 17 Jun 2026 08:18:50 +0000HIGH 7.5: In version 3.22.0 of aimhubio/aim, the LocalFileManager._cleanup function in the aim tracking server accepts a user-specified glob-pattern for deleting files. The function does not verify that the matched files are within the directory managed by LocalFileManager, allowing a maliciously crafted globhttps://patchthecve.com/cve/CVE-2024-6829.htmlhttps://patchthecve.com/cve/CVE-2024-6829.htmlWed, 17 Jun 2026 08:18:47 +0000CRITICAL 9.1: A vulnerability in aimhubio/aim version 3.19.3 allows an attacker to exploit the `tarfile.extractall()` function to extract the contents of a maliciously crafted tarfile to arbitrary locations on the host server. The attacker can control `repo.path` and `run_hash` to bypass directory existence checkhttps://patchthecve.com/cve/CVE-2024-6483.htmlhttps://patchthecve.com/cve/CVE-2024-6483.htmlWed, 17 Jun 2026 08:18:06 +0000MEDIUM 5.3: A vulnerability in the `runs/delete-batch` endpoint of aimhubio/aim version 3.19.3 allows for arbitrary file or directory deletion through path traversal. The endpoint does not mitigate path traversal when handling user-specified run-names, which are used to specify log/metadata files for deletion. https://patchthecve.com/cve/CVE-2024-12778.htmlhttps://patchthecve.com/cve/CVE-2024-12778.htmlWed, 17 Jun 2026 07:00:28 +0000HIGH 7.5: A vulnerability in aimhubio/aim version 3.25.0 allows for a denial of service (DoS) attack. The issue arises when a large number of tracked metrics are retrieved simultaneously from the Aim web API, causing the web server to become unresponsive. The root cause is the lack of a limit on the number ofhttps://patchthecve.com/cve/CVE-2024-12777.htmlhttps://patchthecve.com/cve/CVE-2024-12777.htmlWed, 17 Jun 2026 07:00:28 +0000MEDIUM 5.9: A vulnerability in aimhubio/aim version 3.25.0 allows for a denial of service through the misuse of the sshfs-client. The tracking server, which is single-threaded, can be made unresponsive by requesting it to connect to an unresponsive socket via sshfs. The lack of an additional timeout setting in https://patchthecve.com/cve/CVE-2024-10110.htmlhttps://patchthecve.com/cve/CVE-2024-10110.htmlWed, 17 Jun 2026 06:54:56 +0000HIGH 7.5: In version 3.23.0 of aimhubio/aim, the ScheduledStatusReporter object can be instantiated to run on the main thread of the tracking server, leading to the main thread being blocked indefinitely. This results in a denial of service as the tracking server becomes unable to respond to other requests.https://patchthecve.com/cve/CVE-2024-8863.htmlhttps://patchthecve.com/cve/CVE-2024-8863.htmlWed, 17 Jun 2026 08:23:26 +0000LOW 3.5: A vulnerability, which was classified as problematic, was found in aimhubio aim up to 3.24. Affected is the function dangerouslySetInnerHTML of the file textbox.tsx of the component Text Explorer. The manipulation of the argument query leads to cross site scripting. It is possible to launch the attahttps://patchthecve.com/cve/CVE-2024-6578.htmlhttps://patchthecve.com/cve/CVE-2024-6578.htmlWed, 17 Jun 2026 08:18:16 +0000MEDIUM 5.4: A stored cross-site scripting (XSS) vulnerability exists in aimhubio/aim version 3.19.3. The vulnerability arises from the improper neutralization of input during web page generation, specifically in the logs-tab for runs. The terminal output logs are displayed using the `dangerouslySetInnerHTML` fuhttps://patchthecve.com/cve/CVE-2024-6396.htmlhttps://patchthecve.com/cve/CVE-2024-6396.htmlWed, 17 Jun 2026 08:17:55 +0000CRITICAL 9.8: A vulnerability in the `_backup_run` function in aimhubio/aim version 3.19.3 allows remote attackers to overwrite any file on the host server and exfiltrate arbitrary data. The vulnerability arises due to improper handling of the `run_hash` and `repo.path` parameters, which can be manipulated to crehttps://patchthecve.com/cve/CVE-2024-6227.htmlhttps://patchthecve.com/cve/CVE-2024-6227.htmlWed, 17 Jun 2026 08:17:33 +0000HIGH 7.5: A vulnerability in aimhubio/aim version 3.19.3 allows an attacker to cause an infinite loop by configuring the remote tracking server to point at itself. This results in the server endlessly connecting to itself, rendering it unable to respond to other connections.