Live › vulnerability › CVE-2024-2195
Go to dashboardThe Aim experiment tracker's web API endpoint /api/runs/search/run/ evaluates the query parameter as code, so a remote request can execute arbitrary commands on the server. The advisory describes this as full system compromise, with versions 3.0.0 through 3.25.0 affected.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 15:13 UTC, 0h before NVD. All times on this page are UTC.
Teams that run the Aim web UI or API from the pypi package aim in versions 3.0.0 through 3.25.0 are exposed, especially if the server accepts connections from networks they do not control. Installations where the Aim server is only reachable on localhost or a private network carry lower risk, and users who only use the Python logging library without running the web server are not affected by this endpoint.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| aim | pypi | >= 3.0.0, <= 3.25.0 | – |
| aimstack aim | vendor | >= 3.0.0 | – |
pip show aim and compare the installed version against 3.25.0/api/runs/search/run/aim package to a version above 3.25.0 (fixed version not confirmed in sources; check the GHSA advisory)/api/runs/search/run/Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A critical Remote Code Execution (RCE) vulnerability was identified in the aimhubio/aim project, specifically within the /api/runs/search/run/ endpoint, affecting versions >= 3.0.0. The vulnerability resides in the run_search_api function of the aim/web/api/runs/views.py file, where improper restriction of user access to the RunView object allows for the execution of arbitrary code via the query parameter. This issue enables attackers to execute arbitrary commands on the server, potentially leading to full system compromise.
This page as .md · .json · in your agent: get_signal("CVE-2024-2195")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.