{"id":"CVE-2024-2195","kind":"vulnerability","aliases":["CVE-2024-2195","GHSA-mxvw-cj37-8g2h"],"related":[],"title":"Aim Web API vulnerable to Remote Code Execution","description":"A critical Remote Code Execution (RCE) vulnerability was identified in the aimhubio/aim project, specifically within the `/api/runs/search/run/` endpoint, affecting versions >= 3.0.0. The vulnerability resides in the `run_search_api` function of the `aim/web/api/runs/views.py` file, where improper restriction of user access to the `RunView` object allows for the execution of arbitrary code via the `query` parameter. This issue enables attackers to execute arbitrary commands on the server, potentially leading to full system compromise.","summary":"The Aim experiment tracker's web API endpoint /api/runs/search/run/ evaluates the query parameter as code, so a remote request can execute arbitrary commands on the server. The advisory describes this as full system compromise, with versions 3.0.0 through 3.25.0 affected.","severity":"critical","cvss":9.8,"epss":0.01815,"exploited":false,"exploited_at":null,"products":[{"name":"aim","fixed":[],"affected":">= 3.0.0, <= 3.25.0","ecosystem":"pypi"},{"name":"aimstack aim","fixed":[],"affected":">= 3.0.0","ecosystem":"vendor"}],"ecosystems":["pypi","vendor"],"tags":["aim","cwe-94","ml-experiment-tracking","package","python","self-hosted"],"not_affected_if":["local-only-binding","no-web-server"],"how_to_check":"- Run `pip show aim` and compare the installed version against `3.25.0`\n- Check whether the Aim web server is reachable from untrusted networks, for example on the port listed in your deployment config\n- Search web server or access logs for requests to `/api/runs/search/run/`","fix":"- Upgrade the `aim` package to a version above `3.25.0` (fixed version not confirmed in sources; check the GHSA advisory)\n- Until upgraded, block external access to the Aim web server with a firewall or reverse proxy rule on `/api/runs/search/run/`","status":"open","published_at":"2024-04-10T17:15:54+00:00","first_seen_at":"2026-10-27T15:13:25+00:00","triaged_at":"2026-10-27T15:14:40+00:00","updated_at":"2026-10-27T15:32:59+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-27T15:14:40Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the `aim` package to a version above `3.25.0` (fixed version not confirmed in sources; check the GHSA advisory)\n- Until upgraded, block external access to the Aim web server with a firewall or reverse proxy rule on `/api/runs/search/run/`","reach":"internet","title":"Aim: unauthenticated web API lets remote users run code on server","impact":"high","summary":"The Aim experiment tracker's web API endpoint /api/runs/search/run/ evaluates the query parameter as code, so a remote request can execute arbitrary commands on the server. The advisory describes this as full system compromise, with versions 3.0.0 through 3.25.0 affected.","category":"package","nicknames":[],"who_cares":["python","aim","self-hosted","ml-experiment-tracking"],"confidence":0.7,"needs_auth":"unknown","worst_case":"Remote attacker runs arbitrary commands on the server","analyst_note":"Confirm the fixed version and whether authentication is required; check the GHSA-mxvw-cj37-8g2h advisory page.","how_to_check":"- Run `pip show aim` and compare the installed version against `3.25.0`\n- Check whether the Aim web server is reachable from untrusted networks, for example on the port listed in your deployment config\n- Search web server or access logs for requests to `/api/runs/search/run/`","needs_analyst":true,"not_affected_if":["local-only-binding","no-web-server"],"who_is_affected":"Teams that run the Aim web UI or API from the pypi package `aim` in versions 3.0.0 through 3.25.0 are exposed, especially if the server accepts connections from networks they do not control. Installations where the Aim server is only reachable on localhost or a private network carry lower risk, and users who only use the Python logging library without running the web server are not affected by this endpoint.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000682,"input_tokens":3444,"output_tokens":675,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2024':10A,18A '-2195':11A,19A '-94':25B '/api/runs/search/run':43B,91C '3.0.0':71B,95C '3.25.0':73B '8g2h':16A 'access':114C 'advisori':62B 'affect':74B,93C 'aim':1A,20A,22A,23B,36B 'aim/web/api/runs/views.py':107C 'aimhubio/aim':86C 'aimstack':21A 'allow':119C 'api':3A,41B,103C 'arbitrari':56B,124C,136C 'attack':133C 'cj37':15A 'code':7A,49B,78C,125C 'command':57B,137C 'compromis':68B,146C 'critic':76C 'cve':9A,17A 'cwe':24B 'describ':63B 'enabl':132C 'endpoint':42B,92C 'evalu':44B 'execut':8A,55B,79C,122C,135C 'experi':28B,37B 'file':108C 'full':66B,144C 'function':104C 'ghsa':13A 'ghsa-mxvw-cj37-8g2h':12A 'host':34B 'identifi':83C 'improp':110C 'issu':131C 'lead':142C 'ml':27B 'ml-experiment-track':26B 'mxvw':14A 'object':118C 'packag':30B 'paramet':47B,129C 'potenti':141C 'project':87C 'python':31B 'queri':46B,128C 'rce':80C 'remot':6A,52B,77C 'request':53B 'resid':98C 'restrict':111C 'run':101C 'runview':117C 'search':102C 'self':33B 'self-host':32B 'server':60B,140C 'specif':88C 'system':67B,145C 'track':29B 'tracker':38B 'user':113C 'version':70B,94C 'via':126C 'vulner':4A,81C,97C 'web':2A,40B 'within':89C","nicknames":[],"mitigations":[],"who_affected":"Teams that run the Aim web UI or API from the pypi package `aim` in versions 3.0.0 through 3.25.0 are exposed, especially if the server accepts connections from networks they do not control. Installations where the Aim server is only reachable on localhost or a private network carry lower risk, and users who only use the Python logging library without running the web server are not affected by this endpoint.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2024-04-10T17:15:54+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-mxvw-cj37-8g2h","url":"https://github.com/advisories/GHSA-mxvw-cj37-8g2h","severity":"critical","published_at":"2024-04-10T18:30:48+00:00","modified_at":"2026-10-27T15:11:21+00:00","first_seen_at":"2026-10-27T15:13:25+00:00","fetched_at":"2026-10-27T15:13:25+00:00","note":null},{"source":"nvd","external_id":"CVE-2024-2195","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-2195","severity":null,"published_at":"2024-04-10T17:15:54+00:00","modified_at":"2026-06-17T07:23:54+00:00","first_seen_at":"2026-10-27T15:32:59+00:00","fetched_at":"2026-10-27T15:32:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}